cybernews

CVE-2025-54712 - Hashthemes Easy Elementor Addons Missing Authorization Vulnerability

CVE ID : CVE-2025-54712
Published : Aug. 14, 2025, 7:15 p.m. | 40 minutes ago
Description : Missing Authorization vulnerability in hashthemes Easy Elementor Addons allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Easy Elementor Addons: from n/a through 2.2.7.
Severity: 4.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 19:15:00 GMT

CVE-2025-54715 - UKR Solution Barcode Scanner with Inventory Order Manager Path Traversal

CVE ID : CVE-2025-54715
Published : Aug. 14, 2025, 7:15 p.m. | 40 minutes ago
Description : Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager allows Path Traversal. This issue affects Barcode Scanner with Inventory & Order Manager: from n/a through 1.9.0.
Severity: 4.9 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 19:15:00 GMT

CVE-2025-54717 - e-Plugins WP Membership Missing Authorization Vulnerability

CVE ID : CVE-2025-54717
Published : Aug. 14, 2025, 7:15 p.m. | 40 minutes ago
Description : Missing Authorization vulnerability in e-plugins WP Membership allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Membership: from n/a through 1.6.3.
Severity: 5.4 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 19:15:00 GMT

CVE-2025-54727 - CreativeMindsSolutions CM On Demand Search And Replace Stored Cross-site Scripting

CVE ID : CVE-2025-54727
Published : Aug. 14, 2025, 7:15 p.m. | 40 minutes ago
Description : Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM On Demand Search And Replace allows Stored XSS. This issue affects CM On Demand Search And Replace: from n/a through 1.5.2.
Severity: 5.9 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 19:15:00 GMT

CVE-2025-54728 - CreativeMindsSolutions CM On Demand Search And Replace CSRF Vulnerability

CVE ID : CVE-2025-54728
Published : Aug. 14, 2025, 7:15 p.m. | 40 minutes ago
Description : Cross-Site Request Forgery (CSRF) vulnerability in CreativeMindsSolutions CM On Demand Search And Replace allows Cross Site Request Forgery. This issue affects CM On Demand Search And Replace: from n/a through 1.5.2.
Severity: 4.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 19:15:00 GMT

CVE-2025-54729 - Webba Booking Cross-site Scripting

CVE ID : CVE-2025-54729
Published : Aug. 14, 2025, 7:15 p.m. | 40 minutes ago
Description : Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Webba Appointment Booking Webba Booking allows Stored XSS. This issue affects Webba Booking: from n/a through 6.0.5.
Severity: 5.9 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 19:15:00 GMT

CVE-2025-54730 - PARETO Digital Embedder for Google Reviews Missing Authorization Vulnerability

CVE ID : CVE-2025-54730
Published : Aug. 14, 2025, 7:15 p.m. | 40 minutes ago
Description : Missing Authorization vulnerability in PARETO Digital Embedder for Google Reviews allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Embedder for Google Reviews: from n/a through 1.7.3.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 19:15:00 GMT

CVE-2025-54732 - Shahjada WPDM Premium Packages CSRF Vulnerability

CVE ID : CVE-2025-54732
Published : Aug. 14, 2025, 7:15 p.m. | 40 minutes ago
Description : Cross-Site Request Forgery (CSRF) vulnerability in Shahjada WPDM – Premium Packages allows Cross Site Request Forgery. This issue affects WPDM – Premium Packages: from n/a through 6.0.2.
Severity: 4.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 19:15:00 GMT

CVE-2025-54736 - NordicMade Savoy Information Exposure

CVE ID : CVE-2025-54736
Published : Aug. 14, 2025, 7:15 p.m. | 40 minutes ago
Description : Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in NordicMade Savoy allows Retrieve Embedded Sensitive Data. This issue affects Savoy: from n/a through 3.0.8.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 19:15:00 GMT

CVE-2025-54739 - Nexter Blocks Missing Authorization Vulnerability

CVE ID : CVE-2025-54739
Published : Aug. 14, 2025, 7:15 p.m. | 40 minutes ago
Description : Missing Authorization vulnerability in POSIMYTH Nexter Blocks allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Nexter Blocks: from n/a through 4.5.4.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 19:15:00 GMT

CVE-2025-54740 - Michael Nelson Print My Blog Stored Cross-site Scripting

CVE ID : CVE-2025-54740
Published : Aug. 14, 2025, 7:15 p.m. | 40 minutes ago
Description : Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michael Nelson Print My Blog allows Stored XSS. This issue affects Print My Blog: from n/a through 3.27.9.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 19:15:00 GMT

CVE-2025-54746 - Cartpauj Shortcode Redirect Cross-site Scripting

CVE ID : CVE-2025-54746
Published : Aug. 14, 2025, 7:15 p.m. | 40 minutes ago
Description : Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cartpauj Shortcode Redirect allows Stored XSS. This issue affects Shortcode Redirect: from n/a through 1.0.02.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 19:15:00 GMT

CVE-2025-54747 - WordPress Templatera Cross-Site Scripting (XSS)

CVE ID : CVE-2025-54747
Published : Aug. 14, 2025, 7:15 p.m. | 40 minutes ago
Description : Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpbakery Templatera allows DOM-Based XSS. This issue affects Templatera: from n/a through 2.3.0.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 19:15:00 GMT

CVE-2025-54749 - Crocoblock JetProductGallery Cross-site Scripting

CVE ID : CVE-2025-54749
Published : Aug. 14, 2025, 7:15 p.m. | 40 minutes ago
Description : Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetProductGallery allows Stored XSS. This issue affects JetProductGallery: from n/a through 2.2.0.2.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 19:15:00 GMT

CVE-2025-55708 - ExpressTech Systems Quiz And Survey Master SQL Injection

CVE ID : CVE-2025-55708
Published : Aug. 14, 2025, 7:15 p.m. | 40 minutes ago
Description : Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ExpressTech Systems Quiz And Survey Master allows SQL Injection. This issue affects Quiz And Survey Master: from n/a through 10.2.4.
Severity: 8.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 19:15:00 GMT

CVE-2025-55709 - Visual Composer Website Builder Stored Cross-site Scripting Vulnerability

CVE ID : CVE-2025-55709
Published : Aug. 14, 2025, 7:15 p.m. | 40 minutes ago
Description : Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Visual Composer Visual Composer Website Builder allows Stored XSS. This issue affects Visual Composer Website Builder: from n/a through n/a.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 19:15:00 GMT

CVE-2025-55710 - TaxoPress Information Disclosure

CVE ID : CVE-2025-55710
Published : Aug. 14, 2025, 7:15 p.m. | 40 minutes ago
Description : Insertion of Sensitive Information Into Sent Data vulnerability in Steve Burge TaxoPress allows Retrieve Embedded Sensitive Data. This issue affects TaxoPress: from n/a through 3.37.2.
Severity: 4.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 19:15:00 GMT

CVE-2025-55711 - WordPress Table Builder Stored Cross-Site Scripting (XSS) Vulnerability

CVE ID : CVE-2025-55711
Published : Aug. 14, 2025, 7:15 p.m. | 40 minutes ago
Description : Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Table Builder WP Table Builder allows Stored XSS. This issue affects WP Table Builder: from n/a through 2.0.12.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 19:15:00 GMT

CVE-2025-55712 - POSIMYTH The Plus Addons for Elementor Page Builder Lite Missing Authorization Vulnerability

CVE ID : CVE-2025-55712
Published : Aug. 14, 2025, 7:15 p.m. | 40 minutes ago
Description : Missing Authorization vulnerability in POSIMYTH The Plus Addons for Elementor Page Builder Lite allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects The Plus Addons for Elementor Page Builder Lite: from n/a through 6.3.13.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 19:15:00 GMT

CVE-2025-55713 - Blocksy Stored Cross-Site Scripting

CVE ID : CVE-2025-55713
Published : Aug. 14, 2025, 7:15 p.m. | 40 minutes ago
Description : Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeThemes Blocksy allows Stored XSS. This issue affects Blocksy: from n/a through 2.1.6.
Severity: 5.9 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 19:15:00 GMT

CVE-2025-55714 - Crocoblock JetElements For Elementor Cross-site Scripting (XSS)

CVE ID : CVE-2025-55714
Published : Aug. 14, 2025, 7:15 p.m. | 40 minutes ago
Description : Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor allows Stored XSS. This issue affects JetElements For Elementor: from n/a through 2.7.9.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 19:15:00 GMT

CVE-2025-55716 - VeronaLabs WP Statistics Missing Authorization Vulnerability

CVE ID : CVE-2025-55716
Published : Aug. 14, 2025, 7:15 p.m. | 40 minutes ago
Description : Missing Authorization vulnerability in VeronaLabs WP Statistics allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Statistics: from n/a through 14.15.
Severity: 4.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 19:15:00 GMT

CVE-2025-8975 - Givanz Vvveb Cross-Site Scripting Vulnerability

CVE ID : CVE-2025-8975
Published : Aug. 14, 2025, 7:15 p.m. | 40 minutes ago
Description : A vulnerability was identified in givanz Vvveb up to 1.0.5. This affects an unknown part of the file admin/template/content/edit.tpl. The manipulation of the argument slug leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.6 is able to address this issue. The patch is named 84c11d69df8452dc378feecd17e2a62ac10dac66. It is recommended to upgrade the affected component.
Severity: 3.5 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 19:15:00 GMT

CVE-2025-8976 - "Givanz Vvveb Endpoint Cross-Site Scripting Vulnerability"

CVE ID : CVE-2025-8976
Published : Aug. 14, 2025, 7:15 p.m. | 40 minutes ago
Description : A vulnerability has been found in givanz Vvveb up to 1.0.5. This vulnerability affects unknown code of the file /vadmin123/index.php?module=content/post&type=post of the component Endpoint. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.0.6 is able to address this issue. It is recommended to upgrade the affected component.
Severity: 3.5 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 19:15:00 GMT

CVE-2025-8978 - D-Link DIR-619L Boa Authentication Bypass Vulnerability

CVE ID : CVE-2025-8978
Published : Aug. 14, 2025, 7:15 p.m. | 40 minutes ago
Description : A vulnerability was determined in D-Link DIR-619L 6.02CN02. Affected is the function FirmwareUpgrade of the component boa. The manipulation leads to insufficient verification of data authenticity. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
Severity: 6.6 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 19:15:00 GMT

CVE-2023-43687 - Malwarebytes Race Condition Code Execution Vulnerability

CVE ID : CVE-2023-43687
Published : Aug. 14, 2025, 6:15 p.m. | 28 minutes ago
Description : An issue was discovered in Malwarebytes before 4.6.14.326 and before 5.1.5.116 (and Nebula 2020-10-21 and later). There is a Race condition that leads to code execution because of a lack of locks between file verification and execution.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 18:15:00 GMT

CVE-2024-37945 - Elementor Page Builder WPBITS Addons Stored Cross-site Scripting (XSS)

CVE ID : CVE-2024-37945
Published : Aug. 14, 2025, 6:15 p.m. | 28 minutes ago
Description : Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPBits WPBITS Addons For Elementor Page Builder allows Stored XSS.This issue affects WPBITS Addons For Elementor Page Builder: from n/a through 1.5.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 18:15:00 GMT

CVE-2025-21110 - Dell Data Lakehouse Privilege Escalation Vulnerability

CVE ID : CVE-2025-21110
Published : Aug. 14, 2025, 6:15 p.m. | 28 minutes ago
Description : Dell Data Lakehouse, versions prior to 1.5.0.0, contains an Execution with Unnecessary Privileges vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of service.
Severity: 6.7 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 18:15:00 GMT

CVE-2025-51986 - FreeMODBUS Demo/LINUXTCP Infinite Loop Vulnerability

CVE ID : CVE-2025-51986
Published : Aug. 14, 2025, 6:15 p.m. | 28 minutes ago
Description : An issue was discovered in the demo/LINUXTCP implementation of cwalter-at freemodbus v.2018-09-12 allowing attackers to reach an infinite loop via a crafted length value for a packet.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 18:15:00 GMT

CVE-2025-52335 - EyouCMS Cross Site Scripting (XSS)

CVE ID : CVE-2025-52335
Published : Aug. 14, 2025, 6:15 p.m. | 28 minutes ago
Description : EyouCMS 1.7.3 is vulnerale to Cross Site Scripting (XSS) in index.php, which can be exploited to obtain sensitive information.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 18:15:00 GMT

CVE-2025-8972 - iSourcecode Online Tour and Travel Management System SQL Injection Vulnerability

CVE ID : CVE-2025-8972
Published : Aug. 14, 2025, 6:15 p.m. | 28 minutes ago
Description : A vulnerability was identified in itsourcecode Online Tour and Travel Management System 1.0. This issue affects some unknown processing of the file /admin/page-login.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Severity: 7.3 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 18:15:00 GMT

CVE-2025-8973 - SourceCodester Cashier Queuing System SQL Injection Vulnerability

CVE ID : CVE-2025-8973
Published : Aug. 14, 2025, 6:15 p.m. | 28 minutes ago
Description : A vulnerability has been found in SourceCodester Cashier Queuing System 1.0. Affected is an unknown function of the file /Actions.php. The manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Severity: 7.3 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 18:15:00 GMT

CVE-2025-8974 - Litemall JSON Web Token Handler Remote Hard-Coded Credentials Vulnerability

CVE ID : CVE-2025-8974
Published : Aug. 14, 2025, 6:15 p.m. | 28 minutes ago
Description : A vulnerability was determined in linlinjava litemall up to 1.8.0. Affected by this issue is some unknown functionality of the file litemall-wx-api/src/main/java/org/linlinjava/litemall/wx/util/JwtHelper.java of the component JSON Web Token Handler. The manipulation of the argument SECRET with the input X-Litemall-Token leads to hard-coded credentials. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.
Severity: 3.7 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 18:15:00 GMT

CVE-2025-20254 - Cisco Secure Firewall ASA/FTD IKEv2 Packet Parsing Denial of Service

CVE ID : CVE-2025-20254
Published : Aug. 14, 2025, 5:15 p.m. | 1 hour, 28 minutes ago
Description : A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to trigger a memory leak, resulting in a denial of service (DoS) condition. This vulnerability is due to improper parsing of IKEv2 packets. An attacker could exploit this vulnerability by sending a continuous stream of crafted IKEv2 packets to an affected device. A successful exploit could allow the attacker to partially exhaust system memory, causing system instability like being unable to establish new IKEv2 VPN sessions. A manual reboot of the device is required to recover from this condition.
Severity: 5.8 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 17:15:00 GMT

CVE-2025-20263 - Cisco Secure Firewall Adaptive Security Appliance (ASA) and Cisco Secure Firewall Threat Defense (FTD) Buffer Overflow Vulnerability

CVE ID : CVE-2025-20263
Published : Aug. 14, 2025, 5:15 p.m. | 1 hour, 28 minutes ago
Description : A vulnerability in the web services interface of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a buffer overflow on an affected system.  This vulnerability is due to insufficient boundary checks for specific data that is provided to the web services interface of an affected system. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected system. A successful exploit could allow the attacker to cause a buffer overflow condition on the affected system, which could cause the system to reload, resulting in a denial of service (DoS) condition.
Severity: 8.6 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 17:15:00 GMT

CVE-2025-20265 - "Cisco Secure Firewall Management Center RADIUS Command Injection Vulnerability"

CVE ID : CVE-2025-20265
Published : Aug. 14, 2025, 5:15 p.m. | 1 hour, 28 minutes ago
Description : A vulnerability in the RADIUS subsystem implementation of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to inject arbitrary shell commands that are executed by the device.  This vulnerability is due to a lack of proper handling of user input during the authentication phase. An attacker could exploit this vulnerability by sending crafted input when entering credentials that will be authenticated at the configured RADIUS server. A successful exploit could allow the attacker to execute commands at a high privilege level. Note: For this vulnerability to be exploited, Cisco Secure FMC Software must be configured for RADIUS authentication for the web-based management interface, SSH management, or both.
Severity: 10.0 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 17:15:00 GMT

CVE-2025-20268 - "Cisco Secure Firewall Threat Defense (FTD) Geolocation-Based Remote Access VPN HTTP Bypass Vulnerability"

CVE ID : CVE-2025-20268
Published : Aug. 14, 2025, 5:15 p.m. | 1 hour, 28 minutes ago
Description : A vulnerability in the Geolocation-Based Remote Access (RA) VPN feature of Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass configured policies to allow or deny HTTP connections based on a country or region. This vulnerability exists because the URL string is not fully parsed. An attacker could exploit this vulnerability by sending a crafted HTTP connection through the targeted device. A successful exploit could allow the attacker to bypass configured policies and gain access to a network where the connection should have been denied.
Severity: 5.8 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 17:15:00 GMT

CVE-2025-20301 - Cisco Secure FMC Software Domain Traverse Authorization Bypass

CVE ID : CVE-2025-20301
Published : Aug. 14, 2025, 5:15 p.m. | 1 hour, 28 minutes ago
Description : A vulnerability in the web-based management interface of Cisco Secure FMC Software could allow an authenticated, low-privileged, remote attacker to access troubleshoot files for a different domain. This vulnerability is due to missing authorization checks. An attacker could exploit this vulnerability by directly accessing a troubleshoot file for a different domain that is managed on the same Cisco Secure FMC instance. A successful exploit could allow the attacker to retrieve a troubleshoot file for a different domain, which could allow the attacker to access sensitive information contained in the troubleshoot file.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 17:15:00 GMT

CVE-2025-20302 - "Cisco Secure FMC Domain Report Access Bypass"

CVE ID : CVE-2025-20302
Published : Aug. 14, 2025, 5:15 p.m. | 1 hour, 28 minutes ago
Description : A vulnerability in the web-based management interface of Cisco Secure FMC Software could allow an authenticated, low-privileged, remote attacker to retrieve a generated report from a different domain. This vulnerability is due to missing authorization checks. An attacker could exploit this vulnerability by directly accessing a generated report file for a different domain that is managed on the same Cisco Secure FMC instance. A successful exploit could allow the attacker to access a previously run report for a different domain, which could allow an attacker to read activity recorded in that domain.
Severity: 4.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 17:15:00 GMT

CVE-2025-20306 - Cisco Secure Firewall Management Center FMC Remote Command Execution Vulnerability

CVE ID : CVE-2025-20306
Published : Aug. 14, 2025, 5:15 p.m. | 1 hour, 28 minutes ago
Description : A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticated, remote attacker with Administrator-level privileges to execute arbitrary commands on the underlying operating system. This vulnerability is due to insufficient input validation of certain HTTP request parameters that are sent to the web-based management interface. An attacker could exploit this vulnerability by authenticating to the interface and sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to execute commands as the root user on the affected device. To exploit this vulnerability, an attacker would need Administrator-level credentials.
Severity: 4.9 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 17:15:00 GMT

CVE-2025-50515 - "Empirebak Phome Code Injection Vulnerability"

CVE ID : CVE-2025-50515
Published : Aug. 14, 2025, 5:15 p.m. | 1 hour, 28 minutes ago
Description : An issue was discovered in phome Empirebak 2010 in ebak2008/upload/class/config.php allowing attackers to execute arbitrary code when the config file was loaded.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 17:15:00 GMT

CVE-2025-50817 - "Python-Future Arbitrary Code Execution Vulnerability"

CVE ID : CVE-2025-50817
Published : Aug. 14, 2025, 5:15 p.m. | 1 hour, 28 minutes ago
Description : A vulnerability in the Python-Future 1.0.0 module allows for arbitrary code execution via the unintended import of a file named test.py. When the module is loaded, it automatically imports test.py, if present in the same directory or in the sys.path. This behavior can be exploited by an attacker who has the ability to write files to the server, allowing the execution of arbitrary code.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 17:15:00 GMT

CVE-2025-55192 - Tapo-Control GitHub Actions Code Injection Vulnerability

CVE ID : CVE-2025-55192
Published : Aug. 14, 2025, 5:15 p.m. | 1 hour, 28 minutes ago
Description : HomeAssistant-Tapo-Control offers Control for Tapo cameras as a Home Assistant component. Prior to commit 2a3b80f, there is a code injection vulnerability in the GitHub Actions workflow .github/workflows/issues.yml. It does not affect users of the Home Assistant integration itself — it only impacts the GitHub Actions environment for this repository. The vulnerable workflow directly inserted user-controlled content from the issue body (github.event.issue.body) into a Bash conditional without proper sanitization. A malicious GitHub user could craft an issue body that executes arbitrary commands on the GitHub Actions runner in a privileged context whenever an issue is opened. The potential impact is limited to the repository’s CI/CD environment, which could allow access to repository contents or GitHub Actions secrets. This issue has been patched via commit 2a3b80f. Workarounds involve disabling the affected workflow (issues.yml), replacing the unsafe Bash comparison with a safe quoted grep (or a pure GitHub Actions expression check), or ensuring minimal permissions in workflows (permissions: block) to reduce possible impact.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 17:15:00 GMT

CVE-2025-55195 - Deno Standard Library Prototype Pollution

CVE ID : CVE-2025-55195
Published : Aug. 14, 2025, 5:15 p.m. | 1 hour, 28 minutes ago
Description : @std/toml is the Deno Standard Library. Prior to version 1.0.9, an attacker can pollute the prototype chain in Node.js runtime and Browser when parsing untrusted TOML data, thus achieving Prototype Pollution (PP) vulnerability. This is because the library is merging an untrusted object with an empty object, which by default the empty object has the prototype chain. This issue has been patched in version 1.0.9.
Severity: 7.3 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 17:15:00 GMT

CVE-2025-8968 - iSourcecode Online Tour and Travel Management System SQL Injection Vulnerability

CVE ID : CVE-2025-8968
Published : Aug. 14, 2025, 5:15 p.m. | 1 hour, 28 minutes ago
Description : A vulnerability was identified in itsourcecode Online Tour and Travel Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/disapprove_user.php. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Severity: 7.3 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 17:15:00 GMT

CVE-2025-8969 - iSourcecode Online Tour and Travel Management System SQL Injection Vulnerability

CVE ID : CVE-2025-8969
Published : Aug. 14, 2025, 5:15 p.m. | 1 hour, 28 minutes ago
Description : A vulnerability has been found in itsourcecode Online Tour and Travel Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/approve_user.php. The manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Severity: 7.3 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 17:15:00 GMT

CVE-2025-8970 - iSourcecode Online Tour and Travel Management System SQL Injection

CVE ID : CVE-2025-8970
Published : Aug. 14, 2025, 5:15 p.m. | 1 hour, 28 minutes ago
Description : A vulnerability was found in itsourcecode Online Tour and Travel Management System 1.0. This affects an unknown part of the file /admin/operations/booking.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Severity: 7.3 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 17:15:00 GMT

CVE-2025-8971 - iSourcecode Online Tour and Travel Management System SQL Injection Vulnerability

CVE ID : CVE-2025-8971
Published : Aug. 14, 2025, 5:15 p.m. | 1 hour, 28 minutes ago
Description : A vulnerability was determined in itsourcecode Online Tour and Travel Management System 1.0. This vulnerability affects unknown code of the file /admin/operations/travellers.php. The manipulation of the argument val-username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Severity: 7.3 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 17:15:00 GMT

CVE-2025-9039 - Amazon ECS Agent Cross-Site Access Vulnerability

CVE ID : CVE-2025-9039
Published : Aug. 14, 2025, 5:15 p.m. | 1 hour, 28 minutes ago
Description : We identified an issue in the Amazon ECS agent where, under certain conditions, an introspection server could be accessed off-host by another instance if the instances are in the same security group or if their security groups allow incoming connections that include the port where the server is hosted. This issue does not affect instances where the option to allow off-host access to the introspection server is set to 'false'. This issue has been addressed in ECS agent version 1.97.1. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. If customers cannot update to the latest AMI, they can modify the Amazon EC2 security groups to restrict incoming access to the introspection server port (51678).
Severity: 4.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 17:15:00 GMT

CVE-2025-9043 - Seagate Toolkit Unquoted Search Path Vulnerability

CVE ID : CVE-2025-9043
Published : Aug. 14, 2025, 5:15 p.m. | 1 hour, 28 minutes ago
Description : The service executable path in Seagate Toolkit on Versions prior to 2.34.0.33 on Windows allows an attacker with Admin privileges to exploit a vulnerability as classified under CWE-428: Unquoted Search Path or Element. An attacker with write permissions to the root could place a malicious Program.exe file, which would execute with SYSTEM privileges.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 17:15:00 GMT

CVE-2025-20237 - "Cisco Secure Firewall Adaptive Security Appliance and FTD Software Command Injection"

CVE ID : CVE-2025-20237
Published : Aug. 14, 2025, 5:15 p.m. | 40 minutes ago
Description : A vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system with root-level privileges. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to insufficient input validation of commands that are supplied by the user. An attacker could exploit this vulnerability by authenticating to a device and submitting crafted input for specific commands. A successful exploit could allow the attacker to execute commands on the underlying operating system as root.
Severity: 6.0 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 17:15:00 GMT

CVE-2025-20238 - Cisco Secure Firewall ASA/FTD Command Injection Vulnerability

CVE ID : CVE-2025-20238
Published : Aug. 14, 2025, 5:15 p.m. | 40 minutes ago
Description : A vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system with root-level privileges. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to insufficient input validation of commands that are supplied by the user. An attacker could exploit this vulnerability by authenticating to a device and submitting crafted input for specific commands. A successful exploit could allow the attacker to execute commands on the underlying operating system as root.
Severity: 6.0 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 17:15:00 GMT

CVE-2025-20239 - "Cisco IKEv2 Memory Leak Vulnerability"

CVE ID : CVE-2025-20239
Published : Aug. 14, 2025, 5:15 p.m. | 40 minutes ago
Description : A vulnerability in the Internet Key Exchange Version 2 (IKEv2) feature of Cisco IOS Software, IOS XE Software, Secure Firewall Adaptive Security Appliance (ASA) Software, and Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to trigger a memory leak, resulting in a denial of service (DoS) condition. This vulnerability is due to a lack of proper processing of IKEv2 packets. An attacker could exploit this vulnerability by sending crafted IKEv2 packets to an affected device. In the case of Cisco IOS and IOS XE Software, a successful exploit could allow the attacker to cause the device to reload unexpectedly. In the case of Cisco ASA and FTD Software, a successful exploit could allow the attacker to partially exhaust system memory, causing system instability such as being unable to establish new IKEv2 VPN sessions. A manual reboot of the device is required to recover from this condition.
Severity: 8.6 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 17:15:00 GMT

CVE-2025-20243 - Cisco Secure Firewall ASA/FTD Unauthenticated Remote DoS Vulnerability

CVE ID : CVE-2025-20243
Published : Aug. 14, 2025, 5:15 p.m. | 40 minutes ago
Description : A vulnerability in the management and VPN web servers of Cisco Secure Firewall ASA Software and Secure FTD Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a DoS condition. This vulnerability is due to improper validation of user-supplied input on an interface with VPN web services. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted web server on an affected device. A successful exploit could allow the attacker to cause a DoS condition when the device reloads.
Severity: 8.6 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 17:15:00 GMT

CVE-2025-20244 - Cisco Secure Firewall Adaptive Security Appliance/Threat Defense SSL VPN HTTP Header Field Denial of Service (DoS) Vulnerability

CVE ID : CVE-2025-20244
Published : Aug. 14, 2025, 5:15 p.m. | 40 minutes ago
Description : A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow a remote attacker that is authenticated as a VPN user to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to incomplete error checking when parsing an HTTP header field value. An attacker could exploit this vulnerability by sending a crafted HTTP request to a targeted Remote Access SSL VPN service on an affected device. A successful exploit could allow the attacker to cause a DoS condition, which would cause the affected device to reload.
Severity: 7.7 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 17:15:00 GMT

CVE-2025-20251 - Cisco Secure Firewall ASA/FTD Remote File Creation and Deletion Vulnerability (Authentication Bypass)

CVE ID : CVE-2025-20251
Published : Aug. 14, 2025, 5:15 p.m. | 40 minutes ago
Description : A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker to create or delete arbitrary files on the underlying operating system. If critical system files are manipulated, new Remote Access SSL VPN sessions could be denied and existing sessions could be dropped, causing a denial of service (DoS) condition. An exploited device requires a manual reboot to recover. This vulnerability is due to insufficient input validation when processing HTTP requests. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to create or delete files on the underlying operating system, which could cause the Remote Access SSL VPN service to become unresponsive. To exploit this vulnerability, the attacker must be authenticated as a VPN user of the affected device.
Severity: 8.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 17:15:00 GMT

CVE-2025-20252 - Cisco Secure Firewall Adaptive Security Appliance IKEv2 Memory Leak Denial of Service

CVE ID : CVE-2025-20252
Published : Aug. 14, 2025, 5:15 p.m. | 40 minutes ago
Description : A vulnerability in the Internet Key Exchange Version 2 (IKEv2) module of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to trigger a memory leak, resulting in a denial of service (DoS) condition. This vulnerability is due to improper parsing of IKEv2 packets. An attacker could exploit this vulnerability by sending a continuous stream of crafted IKEv2 packets to an affected device. A successful exploit could allow the attacker to partially exhaust system memory, causing system instability like being unable to establish new IKEv2 VPN sessions. A manual reboot of the device is required to recover from this condition.
Severity: 5.8 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 17:15:00 GMT

CVE-2025-20253 - Cisco IKEv2 DoS Vulnerability

CVE ID : CVE-2025-20253
Published : Aug. 14, 2025, 5:15 p.m. | 40 minutes ago
Description : A vulnerability in the IKEv2 feature of Cisco IOS Software, IOS XE Software, Secure Firewall ASA Software, and Secure FTD Software could allow an unauthenticated, remote attacker to cause the device to reload, resulting in a DoS condition. This vulnerability is due to the improper processing of IKEv2 packets. An attacker could exploit this vulnerability by sending crafted IKEv2 packets to an affected device. A successful exploit could allow the attacker to cause an infinite loop that exhausts resources and could cause the device to reload.
Severity: 8.6 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 17:15:00 GMT

CVE-2023-43694 - Malwarebytes Out-Of-Bounds Read Denial Of Service

CVE ID : CVE-2023-43694
Published : Aug. 14, 2025, 4:15 p.m. | 49 minutes ago
Description : An issue was discovered in Malwarebytes 4.6.14.326 and before and 5.1.5.116 and before (and Nebula 2020-10-21 and later). An Out of bounds read in several disassembling utilities causes stability issues and denial of service.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 16:15:00 GMT

CVE-2025-33142 - IBM WebSphere Application Server TLS Weak Security

CVE ID : CVE-2025-33142
Published : Aug. 14, 2025, 4:15 p.m. | 49 minutes ago
Description : IBM WebSphere Application Server 8.5 and 9.0 could provide weaker than expected security for TLS connections.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 16:15:00 GMT

CVE-2025-36047 - IBM WebSphere Application Server Liberty Denial of Service

CVE ID : CVE-2025-36047
Published : Aug. 14, 2025, 4:15 p.m. | 49 minutes ago
Description : IBM WebSphere Application Server Liberty 18.0.0.2 through 25.0.0.8 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 16:15:00 GMT

CVE-2025-50518 - Libcoap Use-After-Free Vulnerability

CVE ID : CVE-2025-50518
Published : Aug. 14, 2025, 4:15 p.m. | 49 minutes ago
Description : A use-after-free vulnerability exists in the coap_delete_pdu_lkd function within coap_pdu.c of the libcoap library. This issue occurs due to improper handling of memory after the freeing of a PDU object, leading to potential memory corruption or the possibility of executing arbitrary code.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 16:15:00 GMT

CVE-2025-53631 - FlaskBlog Flask XSS Vulnerability

CVE ID : CVE-2025-53631
Published : Aug. 14, 2025, 4:15 p.m. | 49 minutes ago
Description : flaskBlog is a blog app built with Flask. In versions 2.8.1 and prior, improper sanitization of postContent when submitting POST requests to /createpost leads to arbitrary JavaScript execution (XSS) on all pages the post is reflected on including /, /post/[ID], /admin/posts, and /user/[ID] of the user that made the post. At time of publication, there are no public patches available.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 16:15:00 GMT

CVE-2025-54389 - AIDE Terminal Escape Sequence Injection Vulnerability

CVE ID : CVE-2025-54389
Published : Aug. 14, 2025, 4:15 p.m. | 49 minutes ago
Description : AIDE is an advanced intrusion detection environment. Prior to version 0.19.2, there is an improper output neutralization vulnerability in AIDE. An attacker can craft a malicious filename by including terminal escape sequences to hide the addition or removal of the file from the report and/or tamper with the log output. A local user might exploit this to bypass the AIDE detection of malicious files. Additionally the output of extended attribute key names and symbolic links targets are also not properly neutralized. This issue has been patched in version 0.19.2. A workaround involves configuring AIDE to write the report output to a regular file, redirecting stdout to a regular file, or redirecting the log output written to stderr to a regular file.
Severity: 6.2 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 16:15:00 GMT

CVE-2025-54409 - "AIDE Null Pointer Dereference Vulnerability"

CVE ID : CVE-2025-54409
Published : Aug. 14, 2025, 4:15 p.m. | 49 minutes ago
Description : AIDE is an advanced intrusion detection environment. From versions 0.13 to 0.19.1, there is a null pointer dereference vulnerability in AIDE. An attacker can crash the program during report printing or database listing after setting extended file attributes with an empty attribute value or with a key containing a comma. A local user might exploit this to cause a local denial of service. This issue has been patched in version 0.19.2. A workaround involves removing xattrs group from rules matching files on affected file systems.
Severity: 6.2 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 16:15:00 GMT

CVE-2025-54867 - Youki Container Runtime RootFS Escalation

CVE ID : CVE-2025-54867
Published : Aug. 14, 2025, 4:15 p.m. | 49 minutes ago
Description : Youki is a container runtime written in Rust. Prior to version 0.5.5, if /proc and /sys in the rootfs are symbolic links, they can potentially be exploited to gain access to the host root filesystem. This issue has been patched in version 0.5.5.
Severity: 7.0 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 16:15:00 GMT

CVE-2025-8965 - "Litemall Unrestricted File Upload Vulnerability"

CVE ID : CVE-2025-8965
Published : Aug. 14, 2025, 4:15 p.m. | 49 minutes ago
Description : A vulnerability has been found in linlinjava litemall up to 1.8.0. This vulnerability affects the function create of the file litemall-admin-api/src/main/java/org/linlinjava/litemall/admin/web/AdminStorageController.java of the component Endpoint. The manipulation of the argument File leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Severity: 6.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 16:15:00 GMT

CVE-2025-8966 - iSourcecode Online Tour and Travel Management System SQL Injection Vulnerability

CVE ID : CVE-2025-8966
Published : Aug. 14, 2025, 4:15 p.m. | 49 minutes ago
Description : A vulnerability was found in itsourcecode Online Tour and Travel Management System 1.0. This issue affects some unknown processing of the file /admin/operations/tax.php. The manipulation of the argument tname leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Severity: 7.3 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 16:15:00 GMT

CVE-2025-8967 - iSourcecode Online Tour and Travel Management System SQL Injection Vulnerability

CVE ID : CVE-2025-8967
Published : Aug. 14, 2025, 4:15 p.m. | 49 minutes ago
Description : A vulnerability was determined in itsourcecode Online Tour and Travel Management System 1.0. Affected is an unknown function of the file /admin/operations/packages.php. The manipulation of the argument pname leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Severity: 7.3 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 16:15:00 GMT

CVE-2025-36612 - Dell SupportAssist Incorrect Privilege Assignment Vulnerability

CVE ID : CVE-2025-36612
Published : Aug. 14, 2025, 3:15 p.m. | 1 hour, 49 minutes ago
Description : SupportAssist for Business PCs, version(s) 4.5.3 and prior, contain(s) an Incorrect Privilege Assignment vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to elevation of privileges.
Severity: 6.7 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 15:15:00 GMT

CVE-2025-36613 - Dell SupportAssist Incorrect Privilege Assignment Vulnerability

CVE ID : CVE-2025-36613
Published : Aug. 14, 2025, 3:15 p.m. | 1 hour, 49 minutes ago
Description : SupportAssist for Home PCs versions 4.6.3 and prior and SupportAssist for Business PCs versions 4.5.3 and prior, contain(s) an Incorrect Privilege Assignment vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to unauthorized access.
Severity: 2.8 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 15:15:00 GMT

CVE-2025-38738 - Dell SupportAssist Incorrect Privilege Assignment

CVE ID : CVE-2025-38738
Published : Aug. 14, 2025, 3:15 p.m. | 1 hour, 49 minutes ago
Description : SupportAssist for Home PCs Installer exe version(s) 4.8.2.29006 and prior, contain(s) an Incorrect Privilege Assignment vulnerability in the Installer. A low privileged attacker with local access could potentially exploit this vulnerability, leading to elevation of privileges.
Severity: 6.7 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 15:15:00 GMT

CVE-2025-38745 - Dell OpenManage Enterprise Log Insertion Information Exposure

CVE ID : CVE-2025-38745
Published : Aug. 14, 2025, 3:15 p.m. | 1 hour, 49 minutes ago
Description : Dell OpenManage Enterprise, versions 3.10, 4.0, 4.1, and 4.2, contains an Insertion of Sensitive Information into Log File vulnerability in the Backup and Restore. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure.
Severity: 4.8 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 15:15:00 GMT

CVE-2025-40758 - Mendix SAML Authentication Hijacking Vulnerability

CVE ID : CVE-2025-40758
Published : Aug. 14, 2025, 3:15 p.m. | 1 hour, 49 minutes ago
Description : A vulnerability has been identified in Mendix SAML (Mendix 10.12 compatible) (All versions < V4.0.3), Mendix SAML (Mendix 10.21 compatible) (All versions < V4.1.2), Mendix SAML (Mendix 9.24 compatible) (All versions < V3.6.21). Affected versions of the module insufficiently enforce signature validation and binding checks. This could allow unauthenticated remote attackers to hijack an account in specific SSO configurations.
Severity: 8.7 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 15:15:00 GMT

CVE-2025-43983 - KuWFi CPF908-CP5 WEB LCD Device Authentication Bypass and Command Injection

CVE ID : CVE-2025-43983
Published : Aug. 14, 2025, 3:15 p.m. | 1 hour, 49 minutes ago
Description : KuWFi CPF908-CP5 WEB5.0_LCD_20210125 devices have multiple unauthenticated access control vulnerabilities within goform/goform_set_cmd_process and goform/goform_get_cmd_process. These allow an unauthenticated attacker to retrieve sensitive information (including the device admin username and password), modify critical device settings, and send arbitrary SMS messages.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 15:15:00 GMT

CVE-2025-7971 - Rockwell Automation Studio 5000 Logix Designer Environment Variable Injection Vulnerability

CVE ID : CVE-2025-7971
Published : Aug. 14, 2025, 3:15 p.m. | 1 hour, 49 minutes ago
Description : A security issues exists within Studio 5000 Logix Designer due to unsafe handling of environment variables. If the specified path lacks a valid file, Logix Designer crashes; However, it may be possible to execute malicious code without triggering a crash.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 15:15:00 GMT

CVE-2025-7972 - Rockwell Automation FactoryTalk Linx Network Browser Node Validation Bypass

CVE ID : CVE-2025-7972
Published : Aug. 14, 2025, 3:15 p.m. | 1 hour, 49 minutes ago
Description : A security issue exists within the FactoryTalk Linx Network Browser. By modifying the process.env.NODE_ENV to ‘development’, the attacker can disable FTSP token validation. This bypass allows access to create, update, and delete FTLinx drivers.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 15:15:00 GMT

CVE-2025-8875 - N-able N-central Deserialization of Untrusted Data Remote Code Execution Vulnerability

CVE ID : CVE-2025-8875
Published : Aug. 14, 2025, 3:15 p.m. | 1 hour, 49 minutes ago
Description : Deserialization of Untrusted Data vulnerability in N-able N-central allows Local Execution of Code.This issue affects N-central: before 2025.3.1.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 15:15:00 GMT

CVE-2025-8876 - N-able N-central OS Command Injection

CVE ID : CVE-2025-8876
Published : Aug. 14, 2025, 3:15 p.m. | 1 hour, 49 minutes ago
Description : Improper Input Validation vulnerability in N-able N-central allows OS Command Injection.This issue affects N-central: before 2025.3.1.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 15:15:00 GMT

CVE-2025-8962 - Hostel Management System Stack-Based Buffer Overflow Vulnerability

CVE ID : CVE-2025-8962
Published : Aug. 14, 2025, 3:15 p.m. | 1 hour, 49 minutes ago
Description : A vulnerability was found in code-projects Hostel Management System 1.0. Affected by this vulnerability is an unknown functionality of the file hostel_manage.exe of the component Login Form. The manipulation of the argument uname leads to stack-based buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 15:15:00 GMT

CVE-2025-8964 - Code-Projects Hostel Management System Local Authentication Bypass

CVE ID : CVE-2025-8964
Published : Aug. 14, 2025, 3:15 p.m. | 1 hour, 49 minutes ago
Description : A vulnerability was identified in code-projects Hostel Management System 1.0. This affects an unknown part of the file hostel_manage.exe of the component Login. The manipulation leads to improper authentication. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 15:15:00 GMT

CVE-2025-9041 - " Schneider Electric 5094-IF8 CIP Class 32 Inhibition Module Fault Vulnerability"

CVE ID : CVE-2025-9041
Published : Aug. 14, 2025, 3:15 p.m. | 1 hour, 49 minutes ago
Description : A security issue exists due to improper handling of CIP Class 32’s request when a module is inhibited on the 5094-IF8 device. It causes the module to enter a fault state with the Module LED flashing red. Upon un-inhibiting, the module returns a connection fault (Code 16#0010), and the module cannot recover without a power cycle.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 15:15:00 GMT

CVE-2025-9042 - " Schneider Electric 5094-IY8 CIP Class 32 Module Inhibition Vulnerability"

CVE ID : CVE-2025-9042
Published : Aug. 14, 2025, 3:15 p.m. | 1 hour, 49 minutes ago
Description : A security issue exists due to improper handling of CIP Class 32’s request when a module is inhibited on the 5094-IY8 device. It causes the module to enter a fault state with the Module LED flashing red. Upon un-inhibiting, the module returns a connection fault (Code 16#0010), and the module cannot recover without a power cycle.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 15:15:00 GMT

CVE-2025-26484 - Dell CloudLink XML External Entity Reference Denial of Service Vulnerability

CVE ID : CVE-2025-26484
Published : Aug. 14, 2025, 3:15 p.m. | 26 minutes ago
Description : Dell CloudLink, versions 8.0 through 8.1.1, contains an Improper Restriction of XML External Entity Reference vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service.
Severity: 5.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 15:15:00 GMT

CVE-2025-27845 - ESPEC North America Web Controller Authentication Bypass

CVE ID : CVE-2025-27845
Published : Aug. 14, 2025, 3:15 p.m. | 26 minutes ago
Description : In ESPEC North America Web Controller 3 before 3.3.4, /api/v4/auth/ with any invalid authentication request results in exposing a JWT secret. This allows for elevated permissions to the UI.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 15:15:00 GMT

CVE-2025-27846 - ESPEC North America Web Controller Bootloader Privilege Escalation

CVE ID : CVE-2025-27846
Published : Aug. 14, 2025, 3:15 p.m. | 26 minutes ago
Description : In ESPEC North America Web Controller 3 before 3.3.8, an attacker with physical access can gain elevated privileges because GRUB and the BIOS are unprotected.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 15:15:00 GMT

CVE-2025-27847 - ESPEC North America Web Controller Authentication Privilege Escalation

CVE ID : CVE-2025-27847
Published : Aug. 14, 2025, 3:15 p.m. | 26 minutes ago
Description : In ESPEC North America Web Controller 3 before 3.3.8, /api/v4/auth/ users session privileges are not revoked on logout.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 15:15:00 GMT

CVE-2024-53945 - KuWFi 4G AC900 LTE Router Command Injection Vulnerability

CVE ID : CVE-2024-53945
Published : Aug. 14, 2025, 2:15 p.m. | 49 minutes ago
Description : The KuWFi 4G AC900 LTE router 1.0.13 is vulnerable to command injection on the HTTP API endpoints /goform/formMultiApnSetting and /goform/atCmd. An authenticated attacker can execute arbitrary OS commands with root privileges via shell metacharacters in parameters such as pincode and cmds. Exploitation can lead to full system compromise, including enabling remote access (e.g., enabling telnet).
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 14:15:00 GMT

CVE-2024-53946 - KuWFi 4G LTE AC900 Router CSRF Vulnerability

CVE ID : CVE-2024-53946
Published : Aug. 14, 2025, 2:15 p.m. | 49 minutes ago
Description : The KuWFi 4G LTE AC900 router 1.0.13 is vulnerable to Cross-Site Request Forgery (CSRF) on its web management interface. This vulnerability allows an attacker to trick an authenticated admin user into performing unauthorized actions, such as exploiting a command injection vulnerability in /goform/formMultiApnSetting. Successful exploitation can also lead to unauthorized configuration changes.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 14:15:00 GMT

CVE-2025-36581 - Dell PowerEdge AMD BIOS Buffer Access Vulnerability

CVE ID : CVE-2025-36581
Published : Aug. 14, 2025, 2:15 p.m. | 49 minutes ago
Description : Dell PowerEdge Platform version(s) 14G AMD BIOS v1.25.0 and prior, contain(s) an Access of Memory Location After End of Buffer vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure.
Severity: 3.8 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 14:15:00 GMT

CVE-2025-43984 - KuWFi GC111 Command Injection Vulnerability

CVE ID : CVE-2025-43984
Published : Aug. 14, 2025, 2:15 p.m. | 49 minutes ago
Description : An issue was discovered on KuWFi GC111 devices (Hardware Version: CPE-LM321_V3.2, Software Version: GC111-GL-LM321_V3.0_20191211). They are vulnerable to unauthenticated /goform/goform_set_cmd_process requests. A crafted POST request, using the SSID parameter, allows remote attackers to execute arbitrary OS commands with root privileges.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 14:15:00 GMT

CVE-2025-55672 - Apache Superset Stored Cross-Site Scripting (XSS) Vulnerability

CVE ID : CVE-2025-55672
Published : Aug. 14, 2025, 2:15 p.m. | 49 minutes ago
Description : A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can inject a malicious payload into a column's label. The payload is not properly sanitized and gets executed in the victim's browser when they hover over the chart, potentially leading to session hijacking or the execution of arbitrary commands on behalf of the user. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 14:15:00 GMT

CVE-2025-55673 - Apache Superset Database Schema Disclosure

CVE ID : CVE-2025-55673
Published : Aug. 14, 2025, 2:15 p.m. | 49 minutes ago
Description : When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field contains the underlying query, which improperly discloses database schema information, such as table names, to the low-privileged guest user. This issue affects Apache Superset: before 4.1.3. Users are recommended to upgrade to version 4.1.3, which fixes the issue.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 14:15:00 GMT

CVE-2025-55674 - Apache Superset SQL Function Bypass Vulnerability

CVE ID : CVE-2025-55674
Published : Aug. 14, 2025, 2:15 p.m. | 49 minutes ago
Description : A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist. This allows a user with SQL Lab access to execute functions that were intended to be disabled, leading to the disclosure of sensitive database information like the software version. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 14:15:00 GMT

CVE-2025-55675 - Apache Superset Unauthenticated Datasource Enumeration

CVE ID : CVE-2025-55675
Published : Aug. 14, 2025, 2:15 p.m. | 49 minutes ago
Description : Apache Superset contains an improper access control vulnerability in its /explore endpoint. A missing authorization check allows an authenticated user to discover metadata about datasources they do not have permission to access. By iterating through the datasource_id in the URL, an attacker can enumerate and confirm the existence and names of protected datasources, leading to sensitive information disclosure. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 14:15:00 GMT

CVE-2025-7353 - Rockwell Automation ControlLogix Ethernet Modules Remote Code Execution Vulnerability

CVE ID : CVE-2025-7353
Published : Aug. 14, 2025, 2:15 p.m. | 49 minutes ago
Description : A security issue exists due to the web-based debugger agent enabled on Rockwell Automation ControlLogix® Ethernet Modules. If a specific IP address is used to connect to the WDB agent, it can allow remote attackers to perform memory dumps, modify memory, and control execution flow.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 14:15:00 GMT

CVE-2025-7773 - "Fortinet 5032 Web Server Predictable Session ID"

CVE ID : CVE-2025-7773
Published : Aug. 14, 2025, 2:15 p.m. | 49 minutes ago
Description : A security issue exists within the 5032 16pt Digital Configurable module’s web server. The web server’s session number increments at an interval that correlates to the last two consecutive sign in session interval, making it predictable.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 14:15:00 GMT

CVE-2025-7774 - "Fortinet 5032 Session Credential Exposure Vulnerability"

CVE ID : CVE-2025-7774
Published : Aug. 14, 2025, 2:15 p.m. | 49 minutes ago
Description : A security issue exists within the 5032 16pt Digital Configurable module’s web server. Intercepted session credentials can be used within a 3-minute timeout window, allowing unauthorized users to perform privileged actions.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 14:15:00 GMT

CVE-2025-7973 - Allen-Bradley FactoryTalk ViewPoint Privilege Escalation

CVE ID : CVE-2025-7973
Published : Aug. 14, 2025, 2:15 p.m. | 49 minutes ago
Description : A security issue exists in FactoryTalk ViewPoint version 14.0 or below due to improper handling of MSI repair operations. During a repair, attackers can hijack the cscript.exe console window, which runs with SYSTEM privileges. This can be exploited to spawn an elevated command prompt, enabling full privilege escalation.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 14:15:00 GMT

CVE-2025-9036 - Citrix Workspace Token Replay Vulnerability

CVE ID : CVE-2025-9036
Published : Aug. 14, 2025, 2:15 p.m. | 49 minutes ago
Description : A security issue in the runtime event system allows unauthenticated connections to receive a reusable API token. This token is broadcasted over a WebSocket and can be intercepted by any local client listening on the connection.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 14:15:00 GMT

CVE-2023-5342 - Apache Struts Remote Code Execution

CVE ID : CVE-2023-5342
Published : Aug. 14, 2025, 1:15 p.m. | 1 hour, 49 minutes ago
Description : Rejected reason: The original vulnerability was not valid.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 13:15:00 GMT

CVE-2025-8713 - PostgreSQL View and Row Security Statistics Information Disclosure

CVE ID : CVE-2025-8713
Published : Aug. 14, 2025, 1:15 p.m. | 1 hour, 49 minutes ago
Description : PostgreSQL optimizer statistics allow a user to read sampled data within a view that the user cannot access. Separately, statistics allow a user to read sampled data that a row security policy intended to hide. PostgreSQL maintains statistics for tables by sampling data available in columns; this data is consulted during the query planning process. Prior to this release, a user could craft a leaky operator that bypassed view access control lists (ACLs) and bypassed row security policies in partitioning or table inheritance hierarchies. Reachable statistics data notably included histograms and most-common-values lists. CVE-2017-7484 and CVE-2019-10130 intended to close this class of vulnerability, but this gap remained. Versions before PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22 are affected.
Severity: 3.1 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 13:15:00 GMT

CVE-2025-8714 - PostgreSQL Arbitrary Code Execution Vulnerability

CVE ID : CVE-2025-8714
Published : Aug. 14, 2025, 1:15 p.m. | 1 hour, 49 minutes ago
Description : Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql meta-commands. pg_dumpall is also affected. pg_restore is affected when used to generate a plain-format dump. This is similar to MySQL CVE-2024-21096. Versions before PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22 are affected.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 13:15:00 GMT

CVE-2025-8715 - PostgreSQL SQL Injection

CVE ID : CVE-2025-8715
Published : Aug. 14, 2025, 1:15 p.m. | 1 hour, 49 minutes ago
Description : Improper neutralization of newlines in pg_dump in PostgreSQL allows a user of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql meta-commands inside a purpose-crafted object name. The same attacks can achieve SQL injection as a superuser of the restore target server. pg_dumpall, pg_restore, and pg_upgrade are also affected. Versions before PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22 are affected. Versions before 11.20 are unaffected. CVE-2012-0868 had fixed this class of problem, but version 11.20 reintroduced it.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 13:15:00 GMT

CVE-2025-8961 - LibTIFF TIFFcrop Heap-Based Buffer Overflow

CVE ID : CVE-2025-8961
Published : Aug. 14, 2025, 1:15 p.m. | 1 hour, 49 minutes ago
Description : A vulnerability was identified in LibTIFF 4.7.0. This issue affects the function May of the file tiffcrop.c of the component tiffcrop. The manipulation leads to memory corruption. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.
Severity: 3.3 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 13:15:00 GMT

CVE-2025-8963 - Jeecgboot JimuReport Remote Deserialization Vulnerability

CVE ID : CVE-2025-8963
Published : Aug. 14, 2025, 1:15 p.m. | 1 hour, 49 minutes ago
Description : A vulnerability was determined in jeecgboot JimuReport up to 2.1.1. Affected by this issue is some unknown functionality of the file /drag/onlDragDataSource/testConnection of the component Data Large Screen Template. The manipulation leads to deserialization. The attack may be launched remotely. The vendor response to the GitHub issue report is: "Modified, next version updated".
Severity: 6.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 13:15:00 GMT

CVE-2025-8960 - Campcodes Online Flight Booking Management System SQL Injection Vulnerability

CVE ID : CVE-2025-8960
Published : Aug. 14, 2025, 12:15 p.m. | 2 hours, 49 minutes ago
Description : A vulnerability has been found in Campcodes Online Flight Booking Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/save_airlines.php. The manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Severity: 7.3 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 12:15:00 GMT

CVE-2025-54705 - WpEvently Magepeopleteam Missing Authorization Vulnerability

CVE ID : CVE-2025-54705
Published : Aug. 14, 2025, 11:15 a.m. | 3 hours, 49 minutes ago
Description : Missing Authorization vulnerability in magepeopleteam WpEvently allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WpEvently: from n/a through 4.4.6.
Severity: 4.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 11:15:00 GMT

CVE-2025-54706 - Noor Alam Magical Posts Display Cross-site Scripting (XSS)

CVE ID : CVE-2025-54706
Published : Aug. 14, 2025, 11:15 a.m. | 3 hours, 49 minutes ago
Description : Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noor Alam Magical Posts Display allows DOM-Based XSS. This issue affects Magical Posts Display: from n/a through 1.2.52.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 11:15:00 GMT

CVE-2025-54707 - RealMag777 MDTF SQL Injection

CVE ID : CVE-2025-54707
Published : Aug. 14, 2025, 11:15 a.m. | 3 hours, 49 minutes ago
Description : Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 MDTF allows SQL Injection. This issue affects MDTF: from n/a through 1.3.3.7.
Severity: 9.3 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 11:15:00 GMT

CVE-2025-8957 - Campcodes Online Flight Booking Management System SQL Injection

CVE ID : CVE-2025-8957
Published : Aug. 14, 2025, 11:15 a.m. | 3 hours, 49 minutes ago
Description : A vulnerability was determined in Campcodes Online Flight Booking Management System 1.0. Affected is an unknown function of the file /flights.php. The manipulation of the argument departure_airport_id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Severity: 7.3 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 11:15:00 GMT

CVE-2025-8958 - Tenda WiFi Stack-Based Buffer Overflow

CVE ID : CVE-2025-8958
Published : Aug. 14, 2025, 11:15 a.m. | 3 hours, 49 minutes ago
Description : A vulnerability was identified in Tenda TX3 16.03.13.11_multi_TDE01. Affected by this vulnerability is an unknown functionality of the file /goform/fast_setting_wifi_set. The manipulation of the argument ssid leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 11:15:00 GMT

CVE-2025-54692 - WP Swings Membership For WooCommerce Missing Authorization Vulnerability

CVE ID : CVE-2025-54692
Published : Aug. 14, 2025, 11:15 a.m. | 3 hours, 1 minute ago
Description : Missing Authorization vulnerability in WP Swings Membership For WooCommerce allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Membership For WooCommerce: from n/a through 2.9.0.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 11:15:00 GMT

CVE-2025-54693 - Epiphyt Form Block Unrestricted File Upload Vulnerability

CVE ID : CVE-2025-54693
Published : Aug. 14, 2025, 11:15 a.m. | 3 hours, 1 minute ago
Description : Unrestricted Upload of File with Dangerous Type vulnerability in epiphyt Form Block allows Upload a Web Shell to a Web Server. This issue affects Form Block: from n/a through 1.5.5.
Severity: 9.0 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 11:15:00 GMT

CVE-2025-54694 - bPlugins Button Block CSRF Vulnerability

CVE ID : CVE-2025-54694
Published : Aug. 14, 2025, 11:15 a.m. | 3 hours, 1 minute ago
Description : Cross-Site Request Forgery (CSRF) vulnerability in bPlugins Button Block allows Cross Site Request Forgery. This issue affects Button Block: from n/a through 1.2.0.
Severity: 4.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 11:15:00 GMT

CVE-2025-54695 - HasTech HT Mega Missing Authorization Vulnerability

CVE ID : CVE-2025-54695
Published : Aug. 14, 2025, 11:15 a.m. | 3 hours, 1 minute ago
Description : Missing Authorization vulnerability in HasTech HT Mega allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects HT Mega: from n/a through 2.9.0.
Severity: 5.4 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 11:15:00 GMT

CVE-2025-54696 - WPFunnels Cross-site Scripting (XSS)

CVE ID : CVE-2025-54696
Published : Aug. 14, 2025, 11:15 a.m. | 3 hours, 1 minute ago
Description : Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFunnels WPFunnels allows Stored XSS. This issue affects WPFunnels: from n/a through 3.5.26.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 11:15:00 GMT

CVE-2025-54697 - Ben Ritner Kadence WooCommerce Email Designer Privilege Escalation Vulnerability

CVE ID : CVE-2025-54697
Published : Aug. 14, 2025, 11:15 a.m. | 3 hours, 1 minute ago
Description : Incorrect Privilege Assignment vulnerability in Ben Ritner - Kadence WP Kadence WooCommerce Email Designer allows Privilege Escalation. This issue affects Kadence WooCommerce Email Designer: from n/a through 1.5.16.
Severity: 7.2 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 11:15:00 GMT

CVE-2025-54698 - RadiusTheme Classified Listing XSS Injection

CVE ID : CVE-2025-54698
Published : Aug. 14, 2025, 11:15 a.m. | 3 hours, 1 minute ago
Description : Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in RadiusTheme Classified Listing allows Code Injection. This issue affects Classified Listing: from n/a through 5.0.0.
Severity: 5.4 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 11:15:00 GMT

CVE-2025-54699 - Masteriyo LMS Cross-site Scripting

CVE ID : CVE-2025-54699
Published : Aug. 14, 2025, 11:15 a.m. | 3 hours, 1 minute ago
Description : Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in masteriyo Masteriyo - LMS allows Stored XSS. This issue affects Masteriyo - LMS: from n/a through 1.18.3.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 11:15:00 GMT

CVE-2025-54700 - ThemeMove Makeaholic PHP Remote File Inclusion Vulnerability

CVE ID : CVE-2025-54700
Published : Aug. 14, 2025, 11:15 a.m. | 3 hours, 1 minute ago
Description : Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Makeaholic allows PHP Local File Inclusion. This issue affects Makeaholic: from n/a through 1.8.4.
Severity: 8.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 11:15:00 GMT

CVE-2025-54701 - ThemeMove Unicamp PHP Remote File Inclusion Vulnerability

CVE ID : CVE-2025-54701
Published : Aug. 14, 2025, 11:15 a.m. | 3 hours, 1 minute ago
Description : Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Unicamp allows PHP Local File Inclusion. This issue affects Unicamp: from n/a through 2.6.3.
Severity: 8.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 11:15:00 GMT

CVE-2025-54702 - Motov.net Ebook Store CSRF Vulnerability

CVE ID : CVE-2025-54702
Published : Aug. 14, 2025, 11:15 a.m. | 3 hours, 1 minute ago
Description : Cross-Site Request Forgery (CSRF) vulnerability in motov.net Ebook Store allows Cross Site Request Forgery. This issue affects Ebook Store: from n/a through 5.8013.
Severity: 4.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 11:15:00 GMT

CVE-2025-54703 - Prince Integrate Google Drive CSRF

CVE ID : CVE-2025-54703
Published : Aug. 14, 2025, 11:15 a.m. | 3 hours, 1 minute ago
Description : Cross-Site Request Forgery (CSRF) vulnerability in Prince Integrate Google Drive allows Cross Site Request Forgery. This issue affects Integrate Google Drive: from n/a through 1.5.2.
Severity: 4.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 11:15:00 GMT

CVE-2025-54704 - Hashthemes Easy Elementor Addons Cross-Site Scripting Vulnerability

CVE ID : CVE-2025-54704
Published : Aug. 14, 2025, 11:15 a.m. | 3 hours, 1 minute ago
Description : Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hashthemes Easy Elementor Addons allows DOM-Based XSS. This issue affects Easy Elementor Addons: from n/a through 2.2.6.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 11:15:00 GMT

CVE-2025-54686 - Exertio Scriptsbundle Object Injection Vulnerability

CVE ID : CVE-2025-54686
Published : Aug. 14, 2025, 11:15 a.m. | 1 hour, 26 minutes ago
Description : Deserialization of Untrusted Data vulnerability in scriptsbundle Exertio allows Object Injection. This issue affects Exertio: from n/a through 1.3.2.
Severity: 9.8 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 11:15:00 GMT

CVE-2025-54687 - Crocoblock JetTabs Cross-site Scripting Vulnerability

CVE ID : CVE-2025-54687
Published : Aug. 14, 2025, 11:15 a.m. | 1 hour, 26 minutes ago
Description : Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetTabs allows DOM-Based XSS. This issue affects JetTabs: from n/a through 2.2.9.1.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 11:15:00 GMT

CVE-2025-54688 - Crocoblock JetEngine Cross-site Scripting (XSS)

CVE ID : CVE-2025-54688
Published : Aug. 14, 2025, 11:15 a.m. | 1 hour, 26 minutes ago
Description : Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine allows Stored XSS. This issue affects JetEngine: from n/a through 3.7.1.2.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 11:15:00 GMT

CVE-2025-54689 - ThemBay Urna PHP Remote File Inclusion

CVE ID : CVE-2025-54689
Published : Aug. 14, 2025, 11:15 a.m. | 1 hour, 26 minutes ago
Description : Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Urna allows PHP Local File Inclusion. This issue affects Urna: from n/a through 2.5.7.
Severity: 8.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 11:15:00 GMT

CVE-2025-54690 - ThemeStek Xinterio PHP RFI Vulnerability

CVE ID : CVE-2025-54690
Published : Aug. 14, 2025, 11:15 a.m. | 1 hour, 26 minutes ago
Description : Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themeStek Xinterio allows PHP Local File Inclusion. This issue affects Xinterio: from n/a through 4.2.
Severity: 8.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 11:15:00 GMT

CVE-2025-54691 - Stylemix Motors Authorization Bypass

CVE ID : CVE-2025-54691
Published : Aug. 14, 2025, 11:15 a.m. | 1 hour, 26 minutes ago
Description : Authorization Bypass Through User-Controlled Key vulnerability in Stylemix Motors allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Motors: from n/a through 1.4.80.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 11:15:00 GMT

CVE-2025-54685 - Brainstorm Force SureDash Information Disclosure Vulnerability

CVE ID : CVE-2025-54685
Published : Aug. 14, 2025, 11:15 a.m. | 1 hour, 1 minute ago
Description : Insertion of Sensitive Information Into Sent Data vulnerability in Brainstorm Force SureDash allows Retrieve Embedded Sensitive Data. This issue affects SureDash: from n/a through 1.1.0.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 11:15:00 GMT

CVE-2025-48860 - "CtrlX OS Backup Archive Privilege Escalation"

CVE ID : CVE-2025-48860
Published : Aug. 14, 2025, 9:15 a.m. | 1 hour, 9 minutes ago
Description : A vulnerability in the web application of the ctrlX OS setup mechanism facilitated an authenticated (low privileged) attacker to gain remote access to backup archives created by a user with elevated permissions. Depending on the content of the backup archive, the attacker may have been able to access sensitive data.
Severity: 8.0 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 09:15:00 GMT

CVE-2025-48861 - CtrlX OS Task API Remote Information Disclosure

CVE ID : CVE-2025-48861
Published : Aug. 14, 2025, 9:15 a.m. | 1 hour, 9 minutes ago
Description : A vulnerability in the Task API endpoint of the ctrlX OS setup mechanism allowed a remote, unauthenticated attacker to access and extract internal application data, including potential debug logs and the version of installed apps.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 09:15:00 GMT

CVE-2025-48862 - CtrlX OS Unencrypted Backup File Exposure

CVE ID : CVE-2025-48862
Published : Aug. 14, 2025, 9:15 a.m. | 1 hour, 9 minutes ago
Description : Ambiguous wording in the web interface of the ctrlX OS setup mechanism could lead the user to believe that the backup file is encrypted when a password is set. However, only the private key - if available in the backup - is encrypted, while the backup file itself remains unencrypted.
Severity: 7.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 09:15:00 GMT

CVE-2025-54472 - Apache bRPC Redis Protocol Parser Integer Overflow Denial of Service

CVE ID : CVE-2025-54472
Published : Aug. 14, 2025, 9:15 a.m. | 1 hour, 9 minutes ago
Description : Unlimited memory allocation in redis protocol parser in Apache bRPC (all versions < 1.14.1) on all platforms allows attackers to crash the service via network. Root Cause: In the bRPC Redis protocol parser code, memory for arrays or strings of corresponding sizes is allocated based on the integers read from the network. If the integer read from the network is too large, it may cause a bad alloc error and lead to the program crashing. Attackers can exploit this feature by sending special data packets to the bRPC service to carry out a denial-of-service attack on it. The bRPC 1.14.0 version tried to fix this issue by limited the memory allocation size, however, the limitation checking code is not well implemented that may cause integer overflow and evade such limitation. So the 1.14.0 version is also vulnerable, although the integer range that affect version 1.14.0 is different from that affect version < 1.14.0. Affected scenarios: Using bRPC as a Redis server to provide network services to untrusted clients, or using bRPC as a Redis client to call untrusted Redis services. How to Fix: we provide two methods, you can choose one of them: 1. Upgrade bRPC to version 1.14.1. 2. Apply this patch ( https://github.com/apache/brpc/pull/3050 ) manually. No matter you choose which method, you should note that the patch limits the maximum length of memory allocated for each time in the bRPC Redis parser. The default limit is 64M. If some of you redis request or response have a size larger than 64M, you might encounter error after upgrade. For such case, you can modify the gflag redis_max_allocation_size to set a larger limit.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 09:15:00 GMT

CVE-2025-5998 - WordPress PPWP Password Authorization Information Disclosure

CVE ID : CVE-2025-5998
Published : Aug. 14, 2025, 9:15 a.m. | 1 hour, 9 minutes ago
Description : The PPWP – Password Protect Pages WordPress plugin before version 1.9.11 allows to put the site content behind a password authorization, however users with subscriber or greater roles can view content via the REST API.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 09:15:00 GMT

CVE-2025-8952 - Campcodes Online Flight Booking Management System SQL Injection Vulnerability

CVE ID : CVE-2025-8952
Published : Aug. 14, 2025, 9:15 a.m. | 1 hour, 9 minutes ago
Description : A vulnerability was found in Campcodes Online Flight Booking Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/ajax.php?action=login of the component Login. The manipulation of the argument Username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Severity: 7.3 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 09:15:00 GMT

CVE-2025-8953 - SourceCodester COVID 19 Testing Management System SQL Injection Vulnerability

CVE ID : CVE-2025-8953
Published : Aug. 14, 2025, 9:15 a.m. | 1 hour, 9 minutes ago
Description : A vulnerability was determined in SourceCodester COVID 19 Testing Management System 1.0. Affected by this issue is some unknown functionality of the file /check_availability.php. The manipulation of the argument employeeid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Severity: 7.3 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 09:15:00 GMT

CVE-2025-8954 - PHPGurukul Hospital Management System SQL Injection Vulnerability

CVE ID : CVE-2025-8954
Published : Aug. 14, 2025, 9:15 a.m. | 1 hour, 9 minutes ago
Description : A vulnerability was identified in PHPGurukul Hospital Management System 4.0. This affects an unknown part of the file /admin/doctor-specilization.php. The manipulation of the argument doctorspecilization leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Severity: 7.3 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 09:15:00 GMT

CVE-2025-27388 - Apple Safari DOM-Based Cross-Site Scripting (XSS)

CVE ID : CVE-2025-27388
Published : Aug. 14, 2025, 8:15 a.m. | 2 hours, 9 minutes ago
Description : Loading arbitrary external URLs through WebView components introduces malicious JS code that can steal arbitrary user tokens.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 08:15:00 GMT

CVE-2025-8950 - Campcodes Online Recruitment Management System SQL Injection

CVE ID : CVE-2025-8950
Published : Aug. 14, 2025, 8:15 a.m. | 2 hours, 9 minutes ago
Description : A vulnerability was identified in Campcodes Online Recruitment Management System 1.0. This issue affects some unknown processing of the file /Recruitment/index.php?page=view_vacancy. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Severity: 7.3 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 08:15:00 GMT

CVE-2025-8951 - PHPGurukul Teachers Record Management System SQL Injection Vulnerability

CVE ID : CVE-2025-8951
Published : Aug. 14, 2025, 8:15 a.m. | 2 hours, 9 minutes ago
Description : A vulnerability has been found in PHPGurukul Teachers Record Management System 2.1. Affected is an unknown function of the file /admin/search.php. The manipulation of the argument searchdata leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Severity: 7.3 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 08:15:00 GMT

CVE-2025-8947 - Projectworlds Visitor Management System SQL Injection

CVE ID : CVE-2025-8947
Published : Aug. 14, 2025, 7:15 a.m. | 3 hours, 9 minutes ago
Description : A vulnerability was found in projectworlds Visitor Management System 1.0. This issue affects some unknown processing of the file /query_data.php. The manipulation of the argument dateF/dateP leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Severity: 7.3 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 07:15:00 GMT

CVE-2025-8948 - Projectworlds Visitor Management System SQL Injection

CVE ID : CVE-2025-8948
Published : Aug. 14, 2025, 7:15 a.m. | 3 hours, 9 minutes ago
Description : A vulnerability was determined in projectworlds Visitor Management System 1.0. Affected is an unknown function of the file /front.php. The manipulation of the argument rid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Severity: 7.3 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 07:15:00 GMT

CVE-2025-8949 - D-Link DIR-825 HTTPd Stack-Based Buffer Overflow Vulnerability

CVE ID : CVE-2025-8949
Published : Aug. 14, 2025, 7:15 a.m. | 3 hours, 9 minutes ago
Description : A vulnerability was identified in D-Link DIR-825 2.10. Affected by this vulnerability is the function get_ping_app_stat of the file ping_response.cgi of the component httpd. The manipulation of the argument ping_ipaddr leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
Severity: 7.2 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 07:15:00 GMT

CVE-2025-3414 - WordPress Structured Content (JSON-LD) Stored Cross-Site Scripting Vulnerability

CVE ID : CVE-2025-3414
Published : Aug. 14, 2025, 6:15 a.m. | 4 hours, 9 minutes ago
Description : The Structured Content (JSON-LD) #wpsc WordPress plugin before 1.7.0 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 06:15:00 GMT

CVE-2025-6790 - Quiz and Survey Master WordPress CSRF Vulnerability

CVE ID : CVE-2025-6790
Published : Aug. 14, 2025, 6:15 a.m. | 4 hours, 9 minutes ago
Description : The Quiz and Survey Master (QSM) WordPress plugin before 10.2.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 06:15:00 GMT

CVE-2025-7808 - Shopify WP WordPress Stored Cross-Site Scripting

CVE ID : CVE-2025-7808
Published : Aug. 14, 2025, 6:15 a.m. | 4 hours, 9 minutes ago
Description : The WP Shopify WordPress plugin before 1.5.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 06:15:00 GMT

CVE-2025-8046 - "WordPress Injection Guard Reflected Cross-Site Scripting"

CVE ID : CVE-2025-8046
Published : Aug. 14, 2025, 6:15 a.m. | 4 hours, 9 minutes ago
Description : The Injection Guard WordPress plugin before 1.2.8 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 06:15:00 GMT

CVE-2025-8939 - Tenda AC20 Buffer Overflow in WifiGuestSet

CVE ID : CVE-2025-8939
Published : Aug. 14, 2025, 6:15 a.m. | 4 hours, 9 minutes ago
Description : A vulnerability was determined in Tenda AC20 up to 16.03.08.12. Affected is an unknown function of the file /goform/WifiGuestSet. The manipulation of the argument shareSpeed leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 06:15:00 GMT

CVE-2025-8940 - "Tenda AC20 strcpy Buffer Overflow Vulnerability"

CVE ID : CVE-2025-8940
Published : Aug. 14, 2025, 6:15 a.m. | 4 hours, 9 minutes ago
Description : A vulnerability was identified in Tenda AC20 up to 16.03.08.12. Affected by this vulnerability is the function strcpy of the file /goform/saveParentControlInfo. The manipulation of the argument Time leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 06:15:00 GMT

CVE-2025-8946 - Projectworlds Online Notes Sharing Platform SQL Injection Vulnerability

CVE ID : CVE-2025-8946
Published : Aug. 14, 2025, 6:15 a.m. | 4 hours, 9 minutes ago
Description : A vulnerability has been found in projectworlds Online Notes Sharing Platform 1.0. This vulnerability affects unknown code of the file /login.php. The manipulation of the argument User leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Severity: 7.3 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 06:15:00 GMT

CVE-2025-5942 - Netskope NS Client Windows Heap Overflow Denial-of-Service

CVE ID : CVE-2025-5942
Published : Aug. 14, 2025, 5:15 a.m. | 5 hours, 9 minutes ago
Description : Netskope was notified about a potential gap in its agent (NS Client) on Windows systems. If this gap is successfully exploited, an unprivileged user can trigger a heap overflow in the epdlpdrv.sys driver, leading to a Blue-Screen-of-Death (BSOD). Successful exploitation can also potentially be performed by an unprivileged user whose NS Client is configured to use Endpoint DLP. A successful exploit can result in a denial-of-service for the local machine.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 05:15:00 GMT

CVE-2025-8936 - "1000 Projects Sales Management System SQL Injection"

CVE ID : CVE-2025-8936
Published : Aug. 14, 2025, 5:15 a.m. | 5 hours, 9 minutes ago
Description : A vulnerability was determined in 1000 Projects Sales Management System 1.0. Affected by this issue is some unknown functionality of the file /superstore/dist/dordupdate.php. The manipulation of the argument select2 leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Severity: 7.3 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 05:15:00 GMT

CVE-2025-8937 - TOTOLINK N350R Command Injection Vulnerability

CVE ID : CVE-2025-8937
Published : Aug. 14, 2025, 5:15 a.m. | 5 hours, 9 minutes ago
Description : A vulnerability has been found in TOTOLINK N350R 1.2.3-B20130826. This vulnerability affects unknown code of the file /boafrm/formSysCmd. The manipulation leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Severity: 6.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 05:15:00 GMT

CVE-2025-8938 - TOTOLINK N350R Telnet Service Remote Backdoor Vulnerability

CVE ID : CVE-2025-8938
Published : Aug. 14, 2025, 5:15 a.m. | 5 hours, 9 minutes ago
Description : A vulnerability was found in TOTOLINK N350R 1.2.3-B20130826. This issue affects the function formSysTel of the file /boafrm/formSysTel of the component Telnet Service. The manipulation of the argument TelEnabled leads to backdoor. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Severity: 6.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 05:15:00 GMT

CVE-2024-7402 - Netskope Client Administrative Privilege Escalation and Configuration Tampering Vulnerability

CVE ID : CVE-2024-7402
Published : Aug. 14, 2025, 5:15 a.m. | 3 hours, 26 minutes ago
Description : Netskope has identified a potential gap in its agent (Netskope Client) in which a malicious insider can potentially tamper the Netskope Client configuration by performing MITM (Man-in-the-Middle) activity on the Netskope Client communication channel. A successful exploitation would require administrative privileges on the machine, and could result in temporarily altering the configuration of Netskope Client or permanently disabling or removing the agent from the machine.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 05:15:00 GMT

CVE-2025-0309 - Netskope Client TLS Certificate Validation Bypass Privilege Elevation Vulnerability

CVE ID : CVE-2025-0309
Published : Aug. 14, 2025, 5:15 a.m. | 3 hours, 26 minutes ago
Description : An insufficient validation on the server connection endpoint in Netskope Client allows local users to elevate privileges on the system. The insufficient validation allows Netskope Client to connect to any other server with Public Signed CA TLS certificates and send specially crafted responses to elevate privileges.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 05:15:00 GMT

CVE-2025-5941 - Netskope NS Client DNS Memory Leak

CVE ID : CVE-2025-5941
Published : Aug. 14, 2025, 5:15 a.m. | 3 hours, 26 minutes ago
Description : Netskope is notified about a potential gap in its agent (NS Client) in which a malicious actor could trigger a memory leak by sending a crafted DNS packet to a machine. A successful exploitation may require administrative privileges on the machine, based on the exact configuration. A successful exploit can potentially result in user-controllable memory being leaked in a domain name stored on the local machine.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 05:15:00 GMT

CVE-2025-8934 - "1000 Projects Sales Management System Cross-Site Scripting Vulnerability"

CVE ID : CVE-2025-8934
Published : Aug. 14, 2025, 4:16 a.m. | 4 hours, 26 minutes ago
Description : A vulnerability has been found in 1000 Projects Sales Management System 1.0. Affected is an unknown function of the file /sales.php. The manipulation of the argument select2112 leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Severity: 4.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 04:16:00 GMT

CVE-2025-8935 - "1000 Projects Sales Management System SQL Injection Vulnerability"

CVE ID : CVE-2025-8935
Published : Aug. 14, 2025, 4:16 a.m. | 4 hours, 26 minutes ago
Description : A vulnerability was found in 1000 Projects Sales Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /superstore/custcmp.php. The manipulation of the argument Username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Severity: 7.3 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 04:16:00 GMT

CVE-2025-8933 - "1000 Projects Sales Management System Cross Site Scripting Vulnerability"

CVE ID : CVE-2025-8933
Published : Aug. 14, 2025, 4:15 a.m. | 4 hours, 26 minutes ago
Description : A vulnerability was identified in 1000 Projects Sales Management System 1.0. This issue affects some unknown processing of the file /superstore/admin/sales.php. The manipulation of the argument ssalescat leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Severity: 4.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 04:15:00 GMT

CVE-2025-8931 - Code-projects Medical Store Management System SQL Injection

CVE ID : CVE-2025-8931
Published : Aug. 14, 2025, 3:15 a.m. | 5 hours, 26 minutes ago
Description : A vulnerability was determined in code-projects Medical Store Management System 1.0. Affected is an unknown function of the file ChangePassword.java. The manipulation of the argument newPassTxt leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Severity: 6.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 03:15:00 GMT

CVE-2025-8932 - "1000 Projects Sales Management System SQL Injection"

CVE ID : CVE-2025-8932
Published : Aug. 14, 2025, 3:15 a.m. | 5 hours, 26 minutes ago
Description : A vulnerability was determined in 1000 Projects Sales Management System 1.0. This vulnerability affects unknown code of the file /superstore/admin/sales.php. The manipulation of the argument ssalescat leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Severity: 7.3 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 03:15:00 GMT

CVE-2025-8930 - "Code-projects Medical Store Management System SQL Injection Vulnerability"

CVE ID : CVE-2025-8930
Published : Aug. 14, 2025, 3:15 a.m. | 5 hours, 6 minutes ago
Description : A vulnerability was found in code-projects Medical Store Management System 1.0. This issue affects some unknown processing of the file UpdateCompany.java of the component Update Company Page. The manipulation of the argument companyNameTxt leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Severity: 6.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 03:15:00 GMT

CVE-2025-55198 - Helm Chart YAML Parsing Type Error Denial of Service

CVE ID : CVE-2025-55198
Published : Aug. 14, 2025, 12:15 a.m. | 8 hours, 7 minutes ago
Description : Helm is a package manager for Charts for Kubernetes. Prior to version 3.18.5, when parsing Chart.yaml and index.yaml files, an improper validation of type error can lead to a panic. This issue has been resolved in Helm 3.18.5. A workaround involves ensuring YAML files are formatted as Helm expects prior to processing them with Helm.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 00:15:00 GMT

CVE-2025-55199 - Helm Denial of Service (DoS) Vulnerability

CVE ID : CVE-2025-55199
Published : Aug. 14, 2025, 12:15 a.m. | 8 hours, 7 minutes ago
Description : Helm is a package manager for Charts for Kubernetes. Prior to version 3.18.5, it is possible to craft a JSON Schema file in a manner which could cause Helm to use all available memory and have an out of memory (OOM) termination. This issue has been resolved in Helm 3.18.5. A workaround involves ensuring all Helm charts that are being loaded into Helm do not have any reference of $ref pointing to /dev/zero.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Thu, 14 Aug 2025 00:15:00 GMT

CVE-2025-55194 - Part-DB Persistent File Extension Denial of Service

CVE ID : CVE-2025-55194
Published : Aug. 13, 2025, 11:15 p.m. | 7 hours, 26 minutes ago
Description : Part-DB is an open source inventory management system for electronic components. Prior to version 1.17.3, any authenticated user can upload a profile picture with a misleading file extension (e.g., .jpg.txt), resulting in a persistent 500 Internal Server Error when attempting to view or edit that user’s profile. This makes the profile permanently inaccessible via the UI for both users and administrators, constituting a Denial of Service (DoS) within the user management interface. This issue has been patched in version 1.17.3.
Severity: 5.7 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 23:15:00 GMT

CVE-2025-55196 - Kubernetes External Secrets Operator Namespace Bypass Vulnerability

CVE ID : CVE-2025-55196
Published : Aug. 13, 2025, 11:15 p.m. | 7 hours, 26 minutes ago
Description : External Secrets Operator is a Kubernetes operator that integrates external secret management systems. From version 0.15.0 to before 0.19.2, a vulnerability was discovered where the List() calls for Kubernetes Secret and SecretStore resources performed by the PushSecret controller did not apply a namespace selector. This flaw allowed an attacker to use label selectors to list and read secrets/secret-stores across the cluster, bypassing intended namespace restrictions. An attacker with the ability to create or update PushSecret resources and control SecretStore configurations could exploit this vulnerability to exfiltrate sensitive data from arbitrary namespaces. This could lead to full disclosure of Kubernetes secrets, including credentials, tokens, and other sensitive information stored in the cluster. This vulnerability has been patched in version 0.19.2. A workaround for this issue includes auditing and restricting RBAC permissions so that only trusted service accounts can create or update PushSecret and SecretStore resources.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 23:15:00 GMT

CVE-2025-55197 - PyPDF FlateDecode Filter Exhaustion Denial of Service

CVE ID : CVE-2025-55197
Published : Aug. 13, 2025, 11:15 p.m. | 7 hours, 26 minutes ago
Description : pypdf is a free and open-source pure-python PDF library. Prior to version 6.0.0, an attacker can craft a PDF which leads to the RAM being exhausted. This requires just reading the file if a series of FlateDecode filters is used on a malicious cross-reference stream. Other content streams are affected on explicit access. This issue has been fixed in 6.0.0. If an update is not possible, a workaround involves including the fixed code from pypdf.filters.decompress into the existing filters file.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 23:15:00 GMT

CVE-2025-55193 - Ruby on Rails ANSI Sequence Injection Vulnerability

CVE ID : CVE-2025-55193
Published : Aug. 13, 2025, 11:15 p.m. | 7 hours, 2 minutes ago
Description : Active Record connects classes to relational database tables. Prior to versions 7.1.5.2, 7.2.2.2, and 8.0.2.1, the ID passed to find or similar methods may be logged without escaping. If this is directly to the terminal it may include unescaped ANSI sequences. This issue has been patched in versions 7.1.5.2, 7.2.2.2, and 8.0.2.1.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 23:15:00 GMT

CVE-2025-8928 - Code-projects Medical Store Management System SQL Injection Vulnerability

CVE ID : CVE-2025-8928
Published : Aug. 13, 2025, 10:15 p.m. | 8 hours, 2 minutes ago
Description : A vulnerability was identified in code-projects Medical Store Management System 1.0. This affects an unknown part of the file UpdateMedicines.java of the component Update Medicines Page. The manipulation of the argument productNameTxt leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Severity: 6.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 22:15:00 GMT

CVE-2025-8929 - Code-projects Medical Store Management System SQL Injection Vulnerability

CVE ID : CVE-2025-8929
Published : Aug. 13, 2025, 10:15 p.m. | 8 hours, 1 minute ago
Description : A vulnerability has been found in code-projects Medical Store Management System 1.0. This vulnerability affects unknown code of the file MainPanel.java. The manipulation of the argument searchTxt leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Severity: 6.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 22:15:00 GMT

CVE-2012-10058 - RabidHamster Web Server Stack-Based Buffer Overflow Vulnerability

CVE ID : CVE-2012-10058
Published : Aug. 13, 2025, 9:15 p.m. | 9 hours, 1 minute ago
Description : RabidHamster R4 v1.25 contains a stack-based buffer overflow vulnerability due to unsafe use of sprintf() when logging malformed HTTP requests. A remote attacker can exploit this flaw by sending a specially crafted URI, resulting in arbitrary code execution under the context of the web server process.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 21:15:00 GMT

CVE-2012-10059 - Dolibarr ERP/CRM OS Command Injection Vulnerability

CVE ID : CVE-2012-10059
Published : Aug. 13, 2025, 9:15 p.m. | 9 hours, 1 minute ago
Description : Dolibarr ERP/CRM versions <= 3.1.1 and <= 3.2.0 contain a post-authenticated OS command injection vulnerability in its database backup feature. The export.php script fails to sanitize the sql_compat parameter, allowing authenticated users to inject arbitrary system commands, resulting in remote code execution on the server.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 21:15:00 GMT

CVE-2012-10060 - Sysax Multi Server SSH Stack Buffer Overflow

CVE ID : CVE-2012-10060
Published : Aug. 13, 2025, 9:15 p.m. | 9 hours, 1 minute ago
Description : Sysax Multi Server versions prior to 5.55 contains a stack-based buffer overflow in its SSH service. When a remote attacker supplies an overly long username during authentication, the server copies the input to a fixed-size stack buffer without proper bounds checking. This allows remote code execution under the context of the service.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 21:15:00 GMT

CVE-2025-34154 - UnForm Server Manager Unauthenticated File Read Vulnerability

CVE ID : CVE-2025-34154
Published : Aug. 13, 2025, 9:15 p.m. | 9 hours, 1 minute ago
Description : UnForm Server Manager versions prior to 10.1.12 expose an unauthenticated file read vulnerability via its log file analysis interface. The flaw resides in the arc endpoint, which accepts a fl parameter to specify the log file to be opened. Due to insufficient input validation and lack of path sanitization, attackers can supply relative paths to access arbitrary files on the host system — including sensitive OS-level files — without authentication.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 21:15:00 GMT

CVE-2011-10014 - GTA San Andreas Multiplayer (SA-MP) Stack-Based Buffer Overflow Vulnerability

CVE ID : CVE-2011-10014
Published : Aug. 13, 2025, 9:15 p.m. | 7 hours, 7 minutes ago
Description : GTA San Andreas Multiplayer (SA-MP) server version 0.3.1.1 is vulnerable to a stack-based buffer overflow triggered by parsing a malformed server.cfg configuration file. The vulnerability allows local attackers to execute arbitrary code when the server binary (samp-server.exe) processes a crafted echo directive containing excessive input. The original 'sa-mp.com' site is defunct, but the community maintains mirrors and forks that may be vulnerable.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 21:15:00 GMT

CVE-2011-10015 - Cytel Studio Buffer Overflow Vulnerability

CVE ID : CVE-2011-10015
Published : Aug. 13, 2025, 9:15 p.m. | 7 hours, 7 minutes ago
Description : Cytel Studio version 9.0 and earlier is vulnerable to a stack-based buffer overflow triggered by parsing a malformed .CY3 file. The vulnerability occurs when the application copies user-controlled strings into a fixed-size stack buffer (256 bytes) without proper bounds checking. Exploitation allows arbitrary code execution when the crafted file is opened.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 21:15:00 GMT

CVE-2011-10016 - RealNetworks Netzip Classic Stack-Based Buffer Overflow Vulnerability

CVE ID : CVE-2011-10016
Published : Aug. 13, 2025, 9:15 p.m. | 7 hours, 7 minutes ago
Description : Real Networks Netzip Classic version 7.5.1.86 is vulnerable to a stack-based buffer overflow when parsing a specially crafted ZIP archive. The vulnerability is triggered when the application attempts to process a file name within the archive that exceeds the expected buffer size. Exploitation allows arbitrary code execution under the context of the victim user when the ZIP file is opened.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 21:15:00 GMT

CVE-2011-10017 - Snort Nmap PHP Remote Command Execution Vulnerability

CVE ID : CVE-2011-10017
Published : Aug. 13, 2025, 9:15 p.m. | 7 hours, 7 minutes ago
Description : Snort Report versions < 1.3.2 contains a remote command execution vulnerability in the nmap.php and nbtscan.php scripts. These scripts fail to properly sanitize user input passed via the target GET parameter, allowing attackers to inject arbitrary shell commands. Exploitation requires no authentication and can result in full compromise of the underlying system.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 21:15:00 GMT

CVE-2011-10018 - MyBB Unauthorized Remote Code Execution Backdoor

CVE ID : CVE-2011-10018
Published : Aug. 13, 2025, 9:15 p.m. | 7 hours, 7 minutes ago
Description : myBB version 1.6.4 was distributed with an unauthorized backdoor embedded in the source code. The backdoor allowed remote attackers to execute arbitrary PHP code by injecting payloads into a specially crafted collapsed cookie. This vulnerability was introduced during packaging and was not part of the intended application logic. Exploitation requires no authentication and results in full compromise of the web server under the context of the web application.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 21:15:00 GMT

CVE-2011-10019 - Spreecommerce Remote Command Execution Vulnerability

CVE ID : CVE-2011-10019
Published : Aug. 13, 2025, 9:15 p.m. | 7 hours, 7 minutes ago
Description : Spreecommerce versions prior to 0.60.2 contains a remote command execution vulnerability in its search functionality. The application fails to properly sanitize input passed via the search[send][] parameter, which is dynamically invoked using Ruby’s send method. This allows attackers to execute arbitrary shell commands on the server without authentication.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 21:15:00 GMT

CVE-2012-10054 - Umbraco CMS Remote Code Execution Vulnerability

CVE ID : CVE-2012-10054
Published : Aug. 13, 2025, 9:15 p.m. | 7 hours, 7 minutes ago
Description : Umbraco CMS versions prior to 4.7.1 are vulnerable to unauthenticated remote code execution via the codeEditorSave.asmx SOAP endpoint, which exposes a SaveDLRScript operation that permits arbitrary file uploads without authentication. By exploiting a path traversal flaw in the fileName parameter, attackers can write malicious ASPX scripts directly into the web-accessible /umbraco/ directory and execute them remotely.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 21:15:00 GMT

CVE-2012-10055 - F-Secure ComSndFTP Format String Vulnerability

CVE ID : CVE-2012-10055
Published : Aug. 13, 2025, 9:15 p.m. | 7 hours, 7 minutes ago
Description : ComSndFTP FTP Server version 1.3.7 Beta contains a format string vulnerability in its handling of the USER command. By sending a specially crafted username containing format specifiers, a remote attacker can overwrite a hardcoded function pointer in memory (specifically WSACleanup from Ws2_32.dll). This allows the attacker to redirect execution flow and bypass DEP protections using a ROP chain, ultimately leading to arbitrary code execution. The vulnerability is exploitable without authentication and affects default configurations.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 21:15:00 GMT

CVE-2012-10056 - Apache Volunteer Management System Remote File Upload Vulnerability

CVE ID : CVE-2012-10056
Published : Aug. 13, 2025, 9:15 p.m. | 7 hours, 7 minutes ago
Description : PHP Volunteer Management System v1.0.2 contains an arbitrary file upload vulnerability in its document upload functionality. Authenticated users can upload files to the mods/documents/uploads/ directory without any restriction on file type or extension. Because this directory is publicly accessible and lacks execution controls, attackers can upload a malicious PHP payload and execute it remotely. The application ships with default credentials, making exploitation trivial. Once authenticated, the attacker can upload a PHP shell and trigger it via a direct GET request.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 21:15:00 GMT

CVE-2012-10057 - Lattice Semiconductor ispVM Buffer Overflow Vulnerability

CVE ID : CVE-2012-10057
Published : Aug. 13, 2025, 9:15 p.m. | 7 hours, 7 minutes ago
Description : Lattice Semiconductor ispVM System v18.0.2 contains a buffer overflow vulnerability in its handling of .xcf project files. When parsing the version attribute of the ispXCF XML tag, the application fails to properly validate input length, allowing a specially crafted file to overwrite memory on the stack. This can result in arbitrary code execution under the context of the user who opens the file. The vulnerability is triggered locally by opening a malicious .xcf file and does not require elevated privileges.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 21:15:00 GMT

CVE-2011-10011 - WeBid Remote Code Injection Vulnerability

CVE ID : CVE-2011-10011
Published : Aug. 13, 2025, 9:15 p.m. | 5 hours, 26 minutes ago
Description : WeBid 1.0.2 contains a remote code injection vulnerability in the converter.php script, where unsanitized input in the to parameter of a POST request is written directly into includes/currencies.php. This allows unauthenticated attackers to inject arbitrary PHP code, resulting in persistent remote code execution when the modified script is accessed or included by the application.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 21:15:00 GMT

CVE-2011-10012 - Impero Software NetOp Stack-Based Buffer Overflow Vulnerability

CVE ID : CVE-2011-10012
Published : Aug. 13, 2025, 9:15 p.m. | 5 hours, 26 minutes ago
Description : NetOp (now part of Impero Software) Remote Control Client v9.5 is vulnerable to a stack-based buffer overflow when processing .dws configuration files. If a .dws file contains a string longer than 520 bytes, the application fails to perform proper bounds checking, allowing an attacker to execute arbitrary code when the file is opened.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 21:15:00 GMT

CVE-2011-10013 - Traq Remote Code Execution Vulnerability

CVE ID : CVE-2011-10013
Published : Aug. 13, 2025, 9:15 p.m. | 5 hours, 26 minutes ago
Description : Traq versions 2.0 through 2.3 contain a remote code execution vulnerability in the admincp/common.php script. The flawed authorization logic fails to halt execution after a failed access check, allowing unauthenticated users to reach admin-only functionality. This can be exploited via plugins.php to inject and execute arbitrary PHP code.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 21:15:00 GMT

CVE-2011-10009 - Apache S40 CMS Path Traversal Vulnerability

CVE ID : CVE-2011-10009
Published : Aug. 13, 2025, 9:15 p.m. | 1 hour, 6 minutes ago
Description : S40 CMS v0.4.2 contains a path traversal vulnerability in its index.php page handler. The p parameter is not properly sanitized, allowing attackers to traverse the file system and access arbitrary files outside the web root. This can be exploited remotely without authentication by appending traversal sequences and a null byte to bypass file extension checks.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 21:15:00 GMT

CVE-2011-10010 - QuickShare File Server FTP Path Traversal Vulnerability

CVE ID : CVE-2011-10010
Published : Aug. 13, 2025, 9:15 p.m. | 1 hour, 6 minutes ago
Description : QuickShare File Server 1.2.1 contains a path traversal vulnerability in its FTP service due to improper sanitation of user-supplied file paths. Authenticated users can exploit this flaw by submitting crafted sequences to access or write files outside the intended virtual directory. When the "Writable" option is enabled (default during account creation), this allows attackers to upload arbitrary files to privileged locations such as system32, enabling remote code execution via MOF injection or executable placement.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 21:15:00 GMT

CVE-2025-43982 - Tuoshi NR500-EA SSH Default Credential Vulnerability

CVE ID : CVE-2025-43982
Published : Aug. 13, 2025, 8:15 p.m. | 2 hours, 6 minutes ago
Description : Shenzhen Tuoshi NR500-EA RG500UEAABxCOMSLICv3.4.2731.16.43 devices enable the SSH service by default. There is a hidden hard-coded root account that cannot be disabled in the GUI.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 20:15:00 GMT

CVE-2025-43986 - KuWFi GC111 Telnet Authentication Bypass

CVE ID : CVE-2025-43986
Published : Aug. 13, 2025, 8:15 p.m. | 2 hours, 6 minutes ago
Description : An issue was discovered on KuWFi GC111 GC111-GL-LM321_V3.0_20191211 devices. The TELNET service is enabled by default and exposed over the WAN interface without authentication.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 20:15:00 GMT

CVE-2025-43988 - KuWFi 5G01-X55 RCE through Unauthenticated API Endpoint

CVE ID : CVE-2025-43988
Published : Aug. 13, 2025, 8:15 p.m. | 2 hours, 6 minutes ago
Description : KuWFi 5G01-X55 FL2020_V0.0.12 devices expose an unauthenticated API endpoint (ajax_get.cgi), allowing remote attackers to retrieve sensitive configuration data, including admin credentials.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 20:15:00 GMT

CVE-2025-8926 - SourceCodester COVID 19 Testing Management System SQL Injection

CVE ID : CVE-2025-8926
Published : Aug. 13, 2025, 8:15 p.m. | 2 hours, 6 minutes ago
Description : A vulnerability was found in SourceCodester COVID 19 Testing Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /login.php. The manipulation of the argument Username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Severity: 7.3 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 20:15:00 GMT

CVE-2025-8927 - Mtons MBlog Authentication Bypass Vulnerability

CVE ID : CVE-2025-8927
Published : Aug. 13, 2025, 8:15 p.m. | 2 hours, 6 minutes ago
Description : A vulnerability was determined in mtons mblog up to 3.5.0. Affected by this issue is some unknown functionality of the file /email/send_code of the component Verification Code Handler. The manipulation of the argument email leads to improper restriction of excessive authentication attempts. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.
Severity: 3.7 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 20:15:00 GMT

CVE-2025-8925 - iSourcecode Sports Management System SQL Injection Vulnerability

CVE ID : CVE-2025-8925
Published : Aug. 13, 2025, 7:15 p.m. | 3 hours, 6 minutes ago
Description : A vulnerability has been found in itsourcecode Sports Management System 1.0. Affected is an unknown function of the file /Admin/match.php. The manipulation of the argument code leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Severity: 7.3 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 19:15:00 GMT

CVE-2025-43989 - Shenzhen Tuoshi NR500-EA RG500UEAABxCOMSLIC Command Injection Vulnerability

CVE ID : CVE-2025-43989
Published : Aug. 13, 2025, 7:15 p.m. | 1 hour, 26 minutes ago
Description : The /goform/formJsonAjaxReq POST endpoint of Shenzhen Tuoshi NR500-EA RG500UEAABxCOMSLICv3.4.2731.16.43 devices mishandles the set_timesetting action with the ntpserver0 parameter, which is used in a system command. By setting a username=admin cookie (bypassing normal session checks), an unauthenticated attacker can use that parameter to execute arbitrary OS commands.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 19:15:00 GMT

CVE-2025-45313 - Hortusfox Web XSS

CVE ID : CVE-2025-45313
Published : Aug. 13, 2025, 7:15 p.m. | 1 hour, 26 minutes ago
Description : A cross-site scripting (XSS) vulnerability in the /tasks endpoint of hortusfox-web v4.4 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload injected into the title parameter.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 19:15:00 GMT

CVE-2025-8922 - Job Diary SQL Injection Vulnerability

CVE ID : CVE-2025-8922
Published : Aug. 13, 2025, 7:15 p.m. | 1 hour, 26 minutes ago
Description : A vulnerability was found in code-projects Job Diary 1.0. This affects an unknown part of the file /admin-inbox.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Severity: 7.3 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 19:15:00 GMT

CVE-2025-8923 - Code-Projects Job Diary SQL Injection Vulnerability

CVE ID : CVE-2025-8923
Published : Aug. 13, 2025, 7:15 p.m. | 1 hour, 26 minutes ago
Description : A vulnerability was determined in code-projects Job Diary 1.0. This vulnerability affects unknown code of the file /edit-details.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Severity: 7.3 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 19:15:00 GMT

CVE-2025-8924 - Campcodes Online Water Billing System SQL Injection

CVE ID : CVE-2025-8924
Published : Aug. 13, 2025, 7:15 p.m. | 1 hour, 26 minutes ago
Description : A vulnerability was identified in Campcodes Online Water Billing System 1.0. This issue affects some unknown processing of the file /viewbill.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Severity: 7.3 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 19:15:00 GMT

CVE-2025-50615 - Netis WF2880 Buffer Overflow Vulnerability

CVE ID : CVE-2025-50615
Published : Aug. 13, 2025, 6:15 p.m. | 2 hours, 26 minutes ago
Description : A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN_00470c50 function of the cgitest.cgi file. Attackers can trigger this vulnerability by controlling the value of wl_mac_filter_set in the payload, which can cause the program to crash and lead to a Denial of Service (DoS) attack.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 18:15:00 GMT

CVE-2025-50616 - Netis WF2880 Buffer Overflow Vulnerability

CVE ID : CVE-2025-50616
Published : Aug. 13, 2025, 6:15 p.m. | 2 hours, 26 minutes ago
Description : A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN_0046f984 function of the cgitest.cgi file. Attackers can trigger this vulnerability by controlling the value of wl_advanced_set in the payload, which can cause the program to crash and lead to a Denial of Service (DoS) attack.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 18:15:00 GMT

CVE-2025-50617 - Netis WF2880 Buffer Overflow Vulnerability

CVE ID : CVE-2025-50617
Published : Aug. 13, 2025, 6:15 p.m. | 2 hours, 26 minutes ago
Description : A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN_0046ed68 function of the cgitest.cgi file. Attackers can trigger this vulnerability by controlling the value of wps_set in the payload, which can cause the program to crash and potentially lead to a Denial of Service (DoS) attack.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 18:15:00 GMT

CVE-2025-50946 - Olivetin Command Injection Vulnerability

CVE ID : CVE-2025-50946
Published : Aug. 13, 2025, 6:15 p.m. | 2 hours, 26 minutes ago
Description : OS Command Injection in Olivetin 2025.4.22 Custom Themes via the ParseRequestURI function in service/internal/executor/arguments.go.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 18:15:00 GMT

CVE-2025-5819 - GitLab CE/EE Authentication Bypass

CVE ID : CVE-2025-5819
Published : Aug. 13, 2025, 6:15 p.m. | 2 hours, 26 minutes ago
Description : An issue has been discovered in GitLab CE/EE affecting all versions from 15.7 before 17.11.6, 18.0 before 18.0.4, and 18.1 before 18.1.2 that could have allowed authenticated users with developer access to obtain ID tokens for protected branches under certain circumstances.
Severity: 5.0 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 18:15:00 GMT

CVE-2025-6186 - GitLab Cross-Site Scripting (XSS)

CVE ID : CVE-2025-6186
Published : Aug. 13, 2025, 6:15 p.m. | 2 hours, 26 minutes ago
Description : An issue has been discovered in GitLab CE/EE affecting all versions from 18.1 before 18.1.4, and 18.2 before 18.2.2 that could have allowed authenticated users to achieve account takeover by injecting malicious HTML into work item names.
Severity: 8.7 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 18:15:00 GMT

CVE-2025-7734 - GitLab Cross-Site Scripting (XSS)

CVE ID : CVE-2025-7734
Published : Aug. 13, 2025, 6:15 p.m. | 2 hours, 26 minutes ago
Description : An issue has been discovered in GitLab CE/EE affecting all versions from 14.2 before 18.0.6, 18.1 before 18.1.4 and 18.2 before 18.2.2 that, under certain conditions, could have allowed a successful attacker to execute actions on behalf of users by injecting malicious content.
Severity: 8.7 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 18:15:00 GMT

CVE-2025-7739 - GitLab CE/EE Stored Cross-Site Scripting Vulnerability

CVE ID : CVE-2025-7739
Published : Aug. 13, 2025, 6:15 p.m. | 2 hours, 26 minutes ago
Description : An issue has been discovered in GitLab CE/EE affecting all versions from 18.2 before 18.2.2 that, under certain conditions, could have allowed authenticated users to achieve stored cross-site scripting by injecting malicious HTML content in scoped label descriptions.
Severity: 8.7 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 18:15:00 GMT

CVE-2025-8754 - ABB AbilityTM zenon Missing Authentication for Critical Function

CVE ID : CVE-2025-8754
Published : Aug. 13, 2025, 6:15 p.m. | 2 hours, 26 minutes ago
Description : Missing Authentication for Critical Function vulnerability in ABB ABB AbilityTM zenon.This issue affects ABB AbilityTM zenon: from 7.50 through 14.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 18:15:00 GMT

CVE-2025-8770 - GitLab EE Authentication Bypass Vulnerability

CVE ID : CVE-2025-8770
Published : Aug. 13, 2025, 6:15 p.m. | 2 hours, 26 minutes ago
Description : An issue has been discovered in GitLab EE affecting all versions from 18.0 prior to 18.0.6, 18.1 prior to 18.1.4, and 18.2 prior to 18.2.2 that could have allowed authenticated users with specific access to bypass merge request approval policies by manipulating approval rule identifiers.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 18:15:00 GMT

CVE-2025-8904 - Amazon EMR Kerberos Keytab File Disclosure

CVE ID : CVE-2025-8904
Published : Aug. 13, 2025, 6:15 p.m. | 2 hours, 26 minutes ago
Description : Amazon EMR Secret Agent creates a keytab file containing Kerberos credentials. This file is stored in the /tmp/ directory. A user with access to this directory and another account can potentially decrypt the keys and escalate to higher privileges. Users are advised to upgrade to Amazon EMR version 7.5 or higher. For Amazon EMR releases between 6.10 and 7.4, we strongly recommend that you run the bootstrap script and RPM files with the fix provided in the location below.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 18:15:00 GMT

CVE-2025-8919 - Portabilis i-Diario Cross-Site Scripting Vulnerability

CVE ID : CVE-2025-8919
Published : Aug. 13, 2025, 6:15 p.m. | 2 hours, 26 minutes ago
Description : A vulnerability was determined in Portabilis i-Diario up to 1.6. Affected is an unknown function of the file /objetivos-de-aprendizagem-e-habilidades of the component History Page. The manipulation of the argument código/objetivo habilidade leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity: 2.4 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 18:15:00 GMT

CVE-2025-8920 - Portabilis i-Diario Dicionário de Termos BNCC Page Cross-Site Scripting Vulnerability

CVE ID : CVE-2025-8920
Published : Aug. 13, 2025, 6:15 p.m. | 2 hours, 26 minutes ago
Description : A vulnerability was identified in Portabilis i-Diario 1.6. Affected by this vulnerability is an unknown functionality of the file /dicionario-de-termos-bncc of the component Dicionário de Termos BNCC Page. The manipulation of the argument Planos de ensino leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity: 2.4 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 18:15:00 GMT

CVE-2025-8921 - Code-Projects Job Diary SQL Injection Vulnerability

CVE ID : CVE-2025-8921
Published : Aug. 13, 2025, 6:15 p.m. | 2 hours, 26 minutes ago
Description : A vulnerability has been found in code-projects Job Diary 1.0. Affected by this issue is some unknown functionality of the file /user-apply.php. The manipulation of the argument job_title leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Severity: 7.3 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 18:15:00 GMT

CVE-2025-2937 - GitLab Markdown Wiki Denial of Service Vulnerability

CVE ID : CVE-2025-2937
Published : Aug. 13, 2025, 6:15 p.m. | 2 hours, 8 minutes ago
Description : An issue has been discovered in GitLab CE/EE affecting all versions from 13.2 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that could have allowed authenticated users to create a denial of service condition by sending specially crafted markdown payloads to the Wiki feature.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 18:15:00 GMT

CVE-2025-45314 - Hortusfox Web Calendar XSS

CVE ID : CVE-2025-45314
Published : Aug. 13, 2025, 6:15 p.m. | 2 hours, 8 minutes ago
Description : A cross-site scripting (XSS) vulnerability in the /Calendar endpoint of hortusfox-web v4.4 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload injected into the add function.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 18:15:00 GMT

CVE-2025-45315 - Hortusfox Web XSS

CVE ID : CVE-2025-45315
Published : Aug. 13, 2025, 6:15 p.m. | 2 hours, 8 minutes ago
Description : A cross-site scripting (XSS) vulnerability in the /controller/admin.php endpoint of hortusfox-web v4.4 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload injected into the email parameter.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 18:15:00 GMT

CVE-2025-45316 - Hortusfox Web TextBlockModule XSS

CVE ID : CVE-2025-45316
Published : Aug. 13, 2025, 6:15 p.m. | 2 hours, 8 minutes ago
Description : A cross-site scripting (XSS) vulnerability in the TextBlockModule.php component of hortusfox-web v4.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the name parameter.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 18:15:00 GMT

CVE-2025-45317 - Hortusfox-web Zip Slip Vulnerability

CVE ID : CVE-2025-45317
Published : Aug. 13, 2025, 6:15 p.m. | 2 hours, 8 minutes ago
Description : A zip slip vulnerability in the /modules/ImportModule.php component of hortusfox-web v4.4 allows attackers to execute arbitrary code via a crafted archive.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 18:15:00 GMT

CVE-2025-23303 - NVIDIA NeMo Framework Remote Code Execution (RCE)

CVE ID : CVE-2025-23303
Published : Aug. 13, 2025, 6:15 p.m. | 1 hour, 2 minutes ago
Description : NVIDIA NeMo Framework for all platforms contains a vulnerability where a user could cause a deserialization of untrusted data by remote code execution. A successful exploit of this vulnerability might lead to code execution and data tampering.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 18:15:00 GMT

CVE-2025-23304 - NVIDIA NeMo Code Injection Vulnerability

CVE ID : CVE-2025-23304
Published : Aug. 13, 2025, 6:15 p.m. | 1 hour, 2 minutes ago
Description : NVIDIA NeMo library for all platforms contains a vulnerability in the model loading component, where an attacker could cause code injection by loading .nemo files with maliciously crafted metadata. A successful exploit of this vulnerability may lead to remote code execution and data tampering.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 18:15:00 GMT

CVE-2025-23305 - NVIDIA Megatron-LM Code Injection Vulnerability

CVE ID : CVE-2025-23305
Published : Aug. 13, 2025, 6:15 p.m. | 1 hour, 2 minutes ago
Description : NVIDIA Megatron-LM for all platforms contains a vulnerability in the tools component, where an attacker may exploit a code injection issue. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, information disclosure, and data tampering.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 18:15:00 GMT

CVE-2025-23306 - NVIDIA Megatron-LM Code Injection Vulnerability

CVE ID : CVE-2025-23306
Published : Aug. 13, 2025, 6:15 p.m. | 1 hour, 2 minutes ago
Description : NVIDIA Megatron-LM for all platforms contains a vulnerability in the megatron/training/ arguments.py component where an attacker could cause a code injection issue by providing a malicious input. A successful exploit of this vulnerability may lead to code execution, escalation of privileges, information disclosure, and data tampering.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 18:15:00 GMT

CVE-2025-2498 - "Gitlab EE Improper Access Control Vulnerability"

CVE ID : CVE-2025-2498
Published : Aug. 13, 2025, 6:15 p.m. | 1 hour, 2 minutes ago
Description : An improper access control in Gitlab EE affecting all versions from 12.0 prior to 18.0.6, 18.1 prior to 18.1.4, and 18.2 prior to 18.2.2 that under certain conditions could have allowed users to view assigned issues from restricted groups by bypassing IP restrictions.
Severity: 3.1 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 18:15:00 GMT

CVE-2025-2614 - GitLab CE/EE Resource Exhaustion Denial of Service

CVE ID : CVE-2025-2614
Published : Aug. 13, 2025, 6:15 p.m. | 1 hour, 2 minutes ago
Description : An issue has been discovered in GitLab CE/EE affecting all versions from 11.6 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that could have allowed an authenticated user to cause a denial of service condition by creating specially crafted content that consumes excessive server resources when processed.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 18:15:00 GMT

CVE-2025-2180 - Palo Alto Networks Checkov by Prisma Cloud Deserialization Vulnerability

CVE ID : CVE-2025-2180
Published : Aug. 13, 2025, 5:15 p.m. | 1 hour, 1 minute ago
Description : An unsafe deserialization vulnerability in Palo Alto Networks Checkov by Prisma® Cloud allows an authenticated user to execute arbitrary code as a non administrative user by scanning a malicious terraform file when using Checkov in Prisma® Cloud. This issue impacts Checkov 3.0 versions earlier than Checkov 3.2.415.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 17:15:00 GMT

CVE-2025-2181 - Palo Alto Networks Checkov Prisma Cloud Sensitive Information Disclosure

CVE ID : CVE-2025-2181
Published : Aug. 13, 2025, 5:15 p.m. | 1 hour, 1 minute ago
Description : A sensitive information disclosure vulnerability in Palo Alto Networks Checkov by Prisma® Cloud can result in the cleartext exposure of Prisma Cloud access keys in Checkov's output.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 17:15:00 GMT

CVE-2025-2182 - Palo Alto Networks PAN-OS MACsec CAK Exposure

CVE ID : CVE-2025-2182
Published : Aug. 13, 2025, 5:15 p.m. | 1 hour, 1 minute ago
Description : A problem with the implementation of the MACsec protocol in Palo Alto Networks PAN-OS® results in the cleartext exposure of the connectivity association key (CAK). This issue is only applicable to PA-7500 Series devices which are in an NGFW cluster. A user who possesses this key can read messages being sent between devices in a NGFW Cluster. There is no impact in non-clustered firewalls or clusters of firewalls that do not enable MACsec.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 17:15:00 GMT

CVE-2025-2183 - Palo Alto Networks GlobalProtect Certificate Validation Bypass

CVE ID : CVE-2025-2183
Published : Aug. 13, 2025, 5:15 p.m. | 1 hour, 1 minute ago
Description : An insufficient certificate validation issue in the Palo Alto Networks GlobalProtect™ app enables attackers to connect the GlobalProtect app to arbitrary servers. This can enable a local non-administrative operating system user or an attacker on the same subnet to install malicious root certificates on the endpoint and subsequently install malicious software signed by the malicious root certificates on that endpoint.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 17:15:00 GMT

CVE-2025-2184 - Palo Alto Networks Cortex XDR Broker VM Default Credential Sharing Vulnerability

CVE ID : CVE-2025-2184
Published : Aug. 13, 2025, 5:15 p.m. | 1 hour, 1 minute ago
Description : A credential management flaw in Palo Alto Networks Cortex XDR® Broker VM causes different Broker VM images to share identical default credentials for internal services. Users knowing these default credentials could access internal services on other Broker VM installations. The attacker must have network access to the Broker VM to exploit this issue.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 17:15:00 GMT

CVE-2025-34153 - Hyland OnBase .NET Remoting RCE via Insecure Deserialization

CVE ID : CVE-2025-34153
Published : Aug. 13, 2025, 5:15 p.m. | 1 hour, 1 minute ago
Description : Hyland OnBase versions prior to 17.0.2.87 (other versions may be affected) are vulnerable to unauthenticated remote code execution via insecure deserialization on the .NET Remoting TCP channel. The service registers a listener on port 6031 with the URI endpoint TimerServer, implemented in Hyland.Core.Timers.dll. This endpoint deserializes untrusted input using the .NET BinaryFormatter, allowing attackers to execute arbitrary code under the context of NT AUTHORITY\SYSTEM.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 17:15:00 GMT

CVE-2025-50594 - Danphe Health Hospital Management System EMR Password Reset Vulnerability

CVE ID : CVE-2025-50594
Published : Aug. 13, 2025, 5:15 p.m. | 1 hour, 1 minute ago
Description : An issue was discovered in /Code/Websites/DanpheEMR/Controllers/Settings/SecuritySettingsController.cs in Danphe Health Hospital Management System EMR 3.2 allowing attackers to reset any account password.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 17:15:00 GMT

CVE-2025-51451 - TOTOLINK EX1200T Authentication Bypass

CVE ID : CVE-2025-51451
Published : Aug. 13, 2025, 5:15 p.m. | 1 hour, 1 minute ago
Description : In TOTOLINK EX1200T firmware 4.1.2cu.5215, an attacker can bypass login by sending a specific request through formLoginAuth.htm.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 17:15:00 GMT

CVE-2025-52385 - "Studio 3T Remote Code Execution Vulnerability"

CVE ID : CVE-2025-52385
Published : Aug. 13, 2025, 5:15 p.m. | 1 hour, 1 minute ago
Description : An issue in Studio 3T v.2025.1.0 and before allows a remote attacker to execute arbitrary code via a crafted payload to the child_process module
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 17:15:00 GMT

CVE-2025-50608 - Netis WF2880 Buffer Overflow Vulnerability

CVE ID : CVE-2025-50608
Published : Aug. 13, 2025, 4:15 p.m. | 2 hours, 1 minute ago
Description : A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN_00471994 function of the cgitest.cgi file. Attackers can trigger this vulnerability by controlling the value of wl_base_set in the payload, which can cause the program to crash and potentially lead to a Denial of Service (DoS) attack.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 16:15:00 GMT

CVE-2025-50609 - Netis WF2880 Buffer Overflow Vulnerability

CVE ID : CVE-2025-50609
Published : Aug. 13, 2025, 4:15 p.m. | 2 hours, 1 minute ago
Description : A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the Function_00465620 of the cgitest.cgi file. Attackers can trigger this vulnerability by controlling the value of specify_parame in the payload, which can cause the program to crash and potentially lead to a Denial of Service (DoS) attack.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 16:15:00 GMT

CVE-2025-50610 - Netis WF2880 Buffer Overflow Vulnerability

CVE ID : CVE-2025-50610
Published : Aug. 13, 2025, 4:15 p.m. | 2 hours, 1 minute ago
Description : A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN_00476598 function of the cgitest.cgi file. Attackers can trigger this vulnerability by controlling the value of wl_base_set_5g in the payload, which can cause the program to crash and potentially lead to a Denial of Service (DoS) attack.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 16:15:00 GMT

CVE-2025-50611 - Netis WF2880 Buffer Overflow Vulnerability

CVE ID : CVE-2025-50611
Published : Aug. 13, 2025, 4:15 p.m. | 2 hours, 1 minute ago
Description : A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN_00473154 function of the cgitest.cgi file. Attackers can trigger this vulnerability by controlling the value of wl_sec_set_5g and wl_sec_rp_set_5g in the payload, which can cause the program to crash and potentially lead to a Denial of Service (DoS) attack.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 16:15:00 GMT

CVE-2025-50612 - Netis WF2880 Buffer Overflow Vulnerability

CVE ID : CVE-2025-50612
Published : Aug. 13, 2025, 4:15 p.m. | 2 hours, 1 minute ago
Description : A buffer overflow vulnerability has been discovered in the Netis WF2880 v2.1.40207 in the FUN_004743f8 function of the cgitest.cgi file. Attackers can trigger this vulnerability by controlling the value of wl_sec_set in the payload, which may cause the program to crash and potentially lead to a Denial of Service (DoS) attack.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 16:15:00 GMT

CVE-2025-50613 - Netis WF2880 Buffer Overflow Vulnerability

CVE ID : CVE-2025-50613
Published : Aug. 13, 2025, 4:15 p.m. | 2 hours, 1 minute ago
Description : A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN_00475e1c function of the cgitest.cgi file. Attackers can trigger this vulnerability by controlling the value of wds_key_wep in the payload, which can cause the program to crash and potentially lead to a Denial of Service (DoS) attack.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 16:15:00 GMT

CVE-2025-50614 - Netis WF2880 Buffer Overflow Vulnerability

CVE ID : CVE-2025-50614
Published : Aug. 13, 2025, 4:15 p.m. | 2 hours, 1 minute ago
Description : A buffer overflow vulnerability has been discovered in the Netis WF2880 v2.1.40207 in the FUN_0047151c function of the cgitest.cgi file. Attackers can trigger this vulnerability by controlling the value of wds_set in the payload, which can cause the program to crash and potentially lead to a Denial of Service (DoS) attack.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 16:15:00 GMT

CVE-2025-51452 - TOTOLINK A7000R Authentication Bypass Vulnerability

CVE ID : CVE-2025-51452
Published : Aug. 13, 2025, 4:15 p.m. | 2 hours, 1 minute ago
Description : In TOTOLINK A7000R firmware 9.1.0u.6115_B20201022, an attacker can bypass login by sending a specific request through formLoginAuth.htm.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 16:15:00 GMT

CVE-2025-8918 - Portabilis i-Educar Cross-Site Scripting Vulnerability

CVE ID : CVE-2025-8918
Published : Aug. 13, 2025, 4:15 p.m. | 2 hours, 1 minute ago
Description : A vulnerability was found in Portabilis i-Educar up to 2.10. This issue affects some unknown processing of the file /intranet/educar_instituicao_cad.php of the component Editar Page. The manipulation of the argument neighborhood name leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity: 2.4 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 16:15:00 GMT

CVE-2025-51691 - MarkTwo XSS Attack Vector

CVE ID : CVE-2025-51691
Published : Aug. 13, 2025, 3:15 p.m. | 3 hours, 1 minute ago
Description : Cross-Site Scripting (XSS) vulnerability found in MarkTwo commit e3a1d3f90cce4ea9c26efcbbf3a1cbfb9dcdb298 (May 2025) allows a remote attacker to execute arbitrary code via a crafted script input to the editor interface. The application does not properly sanitize user-supplied Markdown before rendering it. Successful exploitation could lead to session hijacking, credential theft, or arbitrary client-side code execution in the context of the victim's browser.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 15:15:00 GMT

CVE-2025-52585 - BIG-IP LTM Anonymous Diffie-Hellman Denial of Service

CVE ID : CVE-2025-52585
Published : Aug. 13, 2025, 3:15 p.m. | 3 hours, 1 minute ago
Description : When a BIG-IP LTM Client SSL profile is configured on a virtual server with SSL Forward Proxy enabled and Anonymous Diffie-Hellman (ADH) ciphers enabled, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 15:15:00 GMT

CVE-2025-53859 - NGINX SMTP Module Information Leak

CVE ID : CVE-2025-53859
Published : Aug. 13, 2025, 3:15 p.m. | 3 hours, 1 minute ago
Description : NGINX Open Source and NGINX Plus have a vulnerability in the ngx_mail_smtp_module that might allow an unauthenticated attacker to over-read NGINX SMTP authentication process memory; as a result, the server side may leak arbitrary bytes sent in a request to the authentication server. This issue happens during the NGINX SMTP authentication process and requires the attacker to make preparations against the target system to extract the leaked data. The issue affects NGINX only if (1) it is built with the ngx_mail_smtp_module, (2) the smtp_auth directive is configured with method "none," and (3) the authentication server returns the "Auth-Wait" response header. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Severity: 3.7 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 15:15:00 GMT

CVE-2025-54500 - Apache HTTP/2 Denial-of-Service Vulnerability

CVE ID : CVE-2025-54500
Published : Aug. 13, 2025, 3:15 p.m. | 3 hours, 1 minute ago
Description : An HTTP/2 implementation flaw allows a denial-of-service (DoS) that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit (HTTP/2 MadeYouReset Attack).  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 15:15:00 GMT

CVE-2025-54809 - F5 Access for Android SSL/TLS Man-in-the-Middle (MitM) Vulnerability

CVE ID : CVE-2025-54809
Published : Aug. 13, 2025, 3:15 p.m. | 3 hours, 1 minute ago
Description : F5 Access for Android before version 3.1.2 which uses HTTPS does not verify the remote endpoint identity. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Severity: 7.4 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 15:15:00 GMT

CVE-2025-55163 - Netty HTTP/2 MadeYouReset DDoS Vulnerability

CVE ID : CVE-2025-55163
Published : Aug. 13, 2025, 3:15 p.m. | 3 hours, 1 minute ago
Description : Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.124.Final and 4.2.4.Final, Netty is vulnerable to MadeYouReset DDoS. This is a logical vulnerability in the HTTP/2 protocol, that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit - which results in resource exhaustion and distributed denial of service. This issue has been patched in versions 4.1.124.Final and 4.2.4.Final.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 15:15:00 GMT

CVE-2025-8941 - Linux-Pam Symlink Privilege Escalation Vulnerability

CVE ID : CVE-2025-8941
Published : Aug. 13, 2025, 3:15 p.m. | 3 hours, 1 minute ago
Description : A flaw was found in linux-pam. The pam_namespace module may improperly handle user-controlled paths, allowing local users to exploit symlink attacks and race conditions to elevate their privileges to root. This CVE provides a "complete" fix for CVE-2025-6020.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 15:15:00 GMT

CVE-2025-46405 - BIG-IP APM Traffic Management Microkernel Denial of Service

CVE ID : CVE-2025-46405
Published : Aug. 13, 2025, 3:15 p.m. | 1 hour, 25 minutes ago
Description : When Network Access is configured on a BIG-IP APM virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 15:15:00 GMT

CVE-2025-48500 - F5 VPN MacOS Browser Client File Integrity Check Bypass

CVE ID : CVE-2025-48500
Published : Aug. 13, 2025, 3:15 p.m. | 1 hour, 25 minutes ago
Description : A missing file integrity check vulnerability exists on MacOS F5 VPN browser client installer that may allow a local, authenticated attacker with access to the local file system to replace it with a malicious package installer.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Severity: 7.3 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 15:15:00 GMT

CVE-2025-50251 - Makeplane Plane SSRF Vulnerability

CVE ID : CVE-2025-50251
Published : Aug. 13, 2025, 3:15 p.m. | 1 hour, 25 minutes ago
Description : Server side request forgery (SSRF) vulnerability in makeplane plane 0.23.1 via the password recovery.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 15:15:00 GMT

CVE-2025-50635 - Netis WF2780 Null Pointer Dereference DoS Vulnerability

CVE ID : CVE-2025-50635
Published : Aug. 13, 2025, 3:15 p.m. | 1 hour, 25 minutes ago
Description : A null pointer dereference vulnerability was discovered in Netis WF2780 v2.2.35445. The vulnerability exists in the FUN_0048a728 function of the cgitest.cgi file. Attackers can trigger this vulnerability by controlling the CONTENT_LENGTH variable, causing the program to crash and potentially leading to a denial-of-service (DoS) attack.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 15:15:00 GMT

CVE-2025-50690 - OSGeo SpatialReference.org Cross-Site Scripting (XSS) Vulnerability

CVE ID : CVE-2025-50690
Published : Aug. 13, 2025, 3:15 p.m. | 1 hour, 25 minutes ago
Description : A Cross-Site Scripting (XSS) vulnerability exists in SpatialReference.org (OSGeo/spatialreference.org) versions prior to 2025-05-17 (commit 2120adfa17ddd535bd0f539e6c4988fa3a2cb491). The vulnerability is caused by improper handling of user input in the search query parameter. An attacker can craft a specially formed URL with malicious JavaScript code, which is then reflected back and executed in the victim's browser. This flaw allows an attacker to execute arbitrary JavaScript in the context of the victim's session, potentially leading to session hijacking, phishing attacks, data theft, or redirection to malicious sites. The issue is exposed on publicly accessible pages, making it exploitable by an unauthenticated attacker.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 15:15:00 GMT

CVE-2025-55005 - ImageMagick Logmap Buffer Overflow Vulnerability

CVE ID : CVE-2025-55005
Published : Aug. 13, 2025, 2:15 p.m. | 2 hours, 25 minutes ago
Description : ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-1, when preparing to transform from Log to sRGB colorspaces, the logmap construction fails to handle cases where the reference-black or reference-white value is larger than 1024. This leads to corrupting memory beyond the end of the allocated logmap buffer. This issue has been patched in version 7.1.2-1.
Severity: 5.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 14:15:00 GMT

CVE-2025-55154 - ImageMagick Stack-Based Buffer Overflow

CVE ID : CVE-2025-55154
Published : Aug. 13, 2025, 2:15 p.m. | 2 hours, 25 minutes ago
Description : ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-27 and 7.1.2-1, the magnified size calculations in ReadOneMNGIMage (in coders/png.c) are unsafe and can overflow, leading to memory corruption. This issue has been patched in versions 6.9.13-27 and 7.1.2-1.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 14:15:00 GMT

CVE-2025-55160 - ImageMagick Denial of Service (DoS) Function-Type Mismatch Vulnerability

CVE ID : CVE-2025-55160
Published : Aug. 13, 2025, 2:15 p.m. | 2 hours, 25 minutes ago
Description : ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-27 and 7.1.2-1, there is undefined behavior (function-type-mismatch) in splay tree cloning callback. This results in a deterministic abort under UBSan (DoS in sanitizer builds), with no crash in a non-sanitized build. This issue has been patched in versions 6.9.13-27 and 7.1.2-1.
Severity: 6.1 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 14:15:00 GMT

CVE-2025-55668 - Apache Tomcat Session Fixation

CVE ID : CVE-2025-55668
Published : Aug. 13, 2025, 2:15 p.m. | 2 hours, 25 minutes ago
Description : Session Fixation vulnerability in Apache Tomcat via rewrite valve. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.41, from 9.0.0.M1 through 9.0.105. Older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.8, 10.1.42 or 9.0.106, which fix the issue.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 14:15:00 GMT

CVE-2025-32451 - Foxit Reader Uninitialized Pointer Memory Corruption Vulnerability

CVE ID : CVE-2025-32451
Published : Aug. 13, 2025, 2:15 p.m. | 47 minutes ago
Description : A memory corruption vulnerability exists in Foxit Reader 2025.1.0.27937 due to the use of an uninitialized pointer. A specially crafted Javascript code inside a malicious PDF document can trigger this vulnerability, which can lead to memory corruption and result in arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially crafted, malicious site if the browser plugin extension is enabled.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 14:15:00 GMT

CVE-2025-52386 - "CycloneDX Sunshine Formula Injection Vulnerability"

CVE ID : CVE-2025-52386
Published : Aug. 13, 2025, 2:15 p.m. | 47 minutes ago
Description : CycloneDX Sunshine v0.9 is vulnerable to CSV Formula Injection via a crafted JSON file
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 14:15:00 GMT

CVE-2025-52392 - Soosyze CMS Unrestricted Brute-Force Login Attack Vulnerability

CVE ID : CVE-2025-52392
Published : Aug. 13, 2025, 2:15 p.m. | 47 minutes ago
Description : Soosyze CMS 2.0 allows brute-force login attacks via the /user/login endpoint due to missing rate-limiting and lockout mechanisms. An attacker can repeatedly submit login attempts without restrictions, potentially gaining unauthorized administrative access. This vulnerability corresponds to CWE-307: Improper Restriction of Excessive Authentication Attempts.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 14:15:00 GMT

CVE-2025-54074 - Cherry Studio OS Command Injection Vulnerability

CVE ID : CVE-2025-54074
Published : Aug. 13, 2025, 2:15 p.m. | 47 minutes ago
Description : Cherry Studio is a desktop client that supports for multiple LLM providers. From versions 1.2.5 to 1.5.1, Cherry Studio is vulnerable to OS Command Injection during a connection with a malicious MCP server in HTTP Streamable mode. Attackers can setup a malicious MCP server with compatible OAuth authorization server endpoints and trick victims into connecting it, leading to OS command injection in vulnerable clients. This issue has been patched in version 1.5.2.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 14:15:00 GMT

CVE-2025-54382 - Cherry Studio Cherry Picker Remote Code Execution

CVE ID : CVE-2025-54382
Published : Aug. 13, 2025, 2:15 p.m. | 47 minutes ago
Description : Cherry Studio is a desktop client that supports for multiple LLM providers. In version 1.5.1, a remote code execution (RCE) vulnerability exists in the Cherry Studio platform when connecting to streamableHttp MCP servers. The issue arises from the server’s implicit trust in the oauth auth redirection endpoints and failure to properly sanitize the URL. This issue has been patched in version 1.5.2.
Severity: 9.6 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 14:15:00 GMT

CVE-2025-54791 - OMERO.web Information Disclosure Vulnerability

CVE ID : CVE-2025-54791
Published : Aug. 13, 2025, 2:15 p.m. | 47 minutes ago
Description : OMERO.web provides a web based client and plugin infrastructure. Prior to version 5.29.2, if an error occurred when resetting a user's password using the Forgot Password option in OMERO.web, the error message displayed on the Web page can disclose information about the user. This issue has been patched in version 5.29.2. A workaround involves disabling the Forgot password option in OMERO.web using the omero.web.show_forgot_password configuration property.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 14:15:00 GMT

CVE-2025-55004 - ImageMagick Heap Buffer Overflow Vulnerability

CVE ID : CVE-2025-55004
Published : Aug. 13, 2025, 2:15 p.m. | 47 minutes ago
Description : ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-1, ImageMagick is vulnerable to heap-buffer overflow read around the handling of images with separate alpha channels when performing image magnification in ReadOneMNGIMage. This can likely be used to leak subsequent memory contents into the output image. This issue has been patched in version 7.1.2-1.
Severity: 7.6 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 14:15:00 GMT

CVE-2025-48989 - Apache Tomcat Reset Attack Vulnerability

CVE ID : CVE-2025-48989
Published : Aug. 13, 2025, 1:15 p.m. | 1 hour, 47 minutes ago
Description : Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 through 9.0.107. Older, EOL versions may also be affected. Users are recommended to upgrade to one of versions 11.0.10, 10.1.44 or 9.0.108 which fix the issue.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 13:15:00 GMT

CVE-2025-8671 - Apache HTTP/2 Denial-of-Service Vulnerability

CVE ID : CVE-2025-8671
Published : Aug. 13, 2025, 1:15 p.m. | 1 hour, 47 minutes ago
Description : A mismatch caused by client-triggered server-sent stream resets between HTTP/2 specifications and the internal architectures of some HTTP/2 implementations may result in excessive server resource consumption leading to denial-of-service (DoS). By opening streams and then rapidly triggering the server to reset them—using malformed frames or flow control errors—an attacker can exploit incorrect stream accounting. Streams reset by the server are considered closed at the protocol level, even though backend processing continues. This allows a client to cause the server to handle an unbounded number of concurrent streams on a single connection. This CVE will be updated as affected product details are released.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 13:15:00 GMT

CVE-2025-8907 - H3C M2 NAS Webserver Configuration Privilege Escalation Vulnerability

CVE ID : CVE-2025-8907
Published : Aug. 13, 2025, 1:15 p.m. | 1 hour, 47 minutes ago
Description : A vulnerability was found in H3C M2 NAS V100R006. Affected by this vulnerability is an unknown functionality of the component Webserver Configuration. The manipulation leads to execution with unnecessary privileges. An attack has to be approached locally. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The vendor explains: "[T]he device only has configuration files and does not actually have boa functionality. It is impossible to access or upload files anonymously to the device through boa services". This vulnerability only affects products that are no longer supported by the maintainer.
Severity: 7.0 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 13:15:00 GMT

CVE-2025-8908 - Shanghai Lingdang Information Technology Lingdang CRM SQL Injection

CVE ID : CVE-2025-8908
Published : Aug. 13, 2025, 1:15 p.m. | 1 hour, 47 minutes ago
Description : A vulnerability was determined in Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.5.4. Affected by this issue is some unknown functionality of the file crm/WeiXinApp/yunzhijia/event.php. The manipulation of the argument openid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 8.6.5 is able to address this issue. It is recommended to upgrade the affected component. The vendor explains: "All SQL injection vectors were patched via parameterized queries and input sanitization in v8.6.5+."
Severity: 6.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 13:15:00 GMT

CVE-2025-54464 - ZKTeco WL20 Unencrypted Credentials Storage

CVE ID : CVE-2025-54464
Published : Aug. 13, 2025, 12:15 p.m. | 2 hours, 47 minutes ago
Description : This vulnerability exists in ZKTeco WL20 due to storage of admin and user credentials without encryption in the device firmware. An attacker with physical access could exploit this vulnerability by extracting the firmware and reverse engineer the binary data to access the unencrypted credentials stored in the firmware of targeted device.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 12:15:00 GMT

CVE-2025-54465 - ZKTeco WL20 Hard-Coded MQTT Credentials Disclosure

CVE ID : CVE-2025-54465
Published : Aug. 13, 2025, 12:15 p.m. | 2 hours, 47 minutes ago
Description : This vulnerability exists in ZKTeco WL20 due to hard-coded MQTT credentials and endpoints stored in plaintext within the device firmware. An attacker with physical access could exploit this vulnerability by extracting the firmware and analyzing the binary data to retrieve the hard-coded MQTT credentials and endpoints from the targeted device. Successful exploitation of this vulnerability could allow the attacker to gain unauthorized access to the MQTT broker and manipulate the communications of the targeted device.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 12:15:00 GMT

CVE-2025-55279 - ZKTeco WL20 Hard-Coded Private Key Vulnerability

CVE ID : CVE-2025-55279
Published : Aug. 13, 2025, 12:15 p.m. | 2 hours, 47 minutes ago
Description : This vulnerability exists in ZKTeco WL20 due to hard-coded private key stored in plaintext within the device firmware. An attacker with physical access could exploit this vulnerability by extracting the firmware and analyzing the binary data to retrieve private key stored in the firmware of the targeted device. Successful exploitation of this vulnerability could allow the attacker to perform unauthorized decryption of sensitive data and Man-in-the-Middle (MitM) attacks on the targeted device.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 12:15:00 GMT

CVE-2025-55280 - ZKTeco WL20 PlainText Data Exposure Vulnerability

CVE ID : CVE-2025-55280
Published : Aug. 13, 2025, 12:15 p.m. | 2 hours, 47 minutes ago
Description : This vulnerability exists in ZKTeco WL20 due to storage of Wi-Fi credentials, configuration data and system data in plaintext within the device firmware. An attacker with physical access could exploit this vulnerability by extracting the firmware and reverse engineer the binary data to access the plaintext sensitive data stored in the targeted device. Successful exploitation of this vulnerability could allow the attacker to gain unauthorized network access, retrieve and manipulate data on the targeted device.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 12:15:00 GMT

Violation de données personnelles Bouygues Telecom

undefined

Wed, 13 Aug 2025 10:18:00 GMT

CVE-2025-8912 - WellChoose Organization Portal System Arbitrary File Reading Vulnerability

CVE ID : CVE-2025-8912
Published : Aug. 13, 2025, 10:15 a.m. | 4 hours, 47 minutes ago
Description : Organization Portal System developed by WellChoose has an Arbitrary File Reading vulnerability, allowing unauthenticated remote attackers to exploit Absolute Path Traversal to download arbitrary system files.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 10:15:00 GMT

CVE-2025-8913 - WellChoose Organization Portal System Local File Inclusion Vulnerability

CVE ID : CVE-2025-8913
Published : Aug. 13, 2025, 10:15 a.m. | 4 hours, 47 minutes ago
Description : Organization Portal System developed by WellChoose has a Local File Inclusion vulnerability, allowing unauthenticated remote attackers to execute arbitrary code on the server.
Severity: 9.8 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 10:15:00 GMT

CVE-2025-8914 - WellChoose Organization Portal System SQL Injection

CVE ID : CVE-2025-8914
Published : Aug. 13, 2025, 10:15 a.m. | 4 hours, 47 minutes ago
Description : Organization Portal System developed by WellChoose has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database contents.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 10:15:00 GMT

CVE-2025-8916 - Bouncy Castle for Java Excessive Allocation Memory Vulnerability

CVE ID : CVE-2025-8916
Published : Aug. 13, 2025, 10:15 a.m. | 4 hours, 47 minutes ago
Description : Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java bcpkix, bcprov, bcpkix-fips on All (API modules) allows Excessive Allocation. This vulnerability is associated with program files https://github.Com/bcgit/bc-java/blob/main/pkix/src/main/java/org/bouncycastle/pkix/jcajce/PKIXCertP... https://github.Com/bcgit/bc-java/blob/main/pkix/src/main/java/org/bouncycastle/pkix/jcajce/PKIXCertPathReviewer.java , https://github.Com/bcgit/bc-java/blob/main/prov/src/main/java/org/bouncycastle/x509/PKIXCertPathRevi... https://github.Com/bcgit/bc-java/blob/main/prov/src/main/java/org/bouncycastle/x509/PKIXCertPathReviewer.java . This issue affects Bouncy Castle for Java: from BC 1.44 through 1.78, from BCPKIX FIPS 1.0.0 through 1.0.7, from BCPKIX FIPS 2.0.0 through 2.0.7.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 10:15:00 GMT

Violation de données personnelles de lrsquo;opérateur Bouygues Telecom : situation, risques et recommandations

L’opérateur de télécommunications Bouygues Telecom a été victime d’une attaque informatique qui a conduit à la violation de données à caractère personnel de certains de ses clients Grand Public dont une partie détenant un numéro SIREN. Il est à noter que les clients de la…

Wed, 13 Aug 2025 10:13:00 GMT

CVE-2025-8910 - WellChoose Organization Portal System Reflected Cross-site Scripting Vulnerability

CVE ID : CVE-2025-8910
Published : Aug. 13, 2025, 9:15 a.m. | 5 hours, 47 minutes ago
Description : Organization Portal System developed by WellChoose has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks.
Severity: 6.1 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 09:15:00 GMT

CVE-2025-8911 - WellChoose Organization Portal System Reflected Cross-site Scripting Vulnerability

CVE ID : CVE-2025-8911
Published : Aug. 13, 2025, 9:15 a.m. | 5 hours, 47 minutes ago
Description : Organization Portal System developed by WellChoose has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks.
Severity: 6.1 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 09:15:00 GMT

CVE-2025-55345 - Codex Symlink File Overwrite RCE

CVE ID : CVE-2025-55345
Published : Aug. 13, 2025, 9:15 a.m. | 3 hours, 25 minutes ago
Description : Using Codex CLI in workspace-write mode inside a malicious context (repo, directory, etc) could lead to arbitrary file overwrite and potentially remote code execution due to symlinks being followed outside the allowed current working directory.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 09:15:00 GMT

CVE-2025-8909 - WellChoose Organization Portal System Arbitrary File Reading Vulnerability

CVE ID : CVE-2025-8909
Published : Aug. 13, 2025, 9:15 a.m. | 3 hours, 25 minutes ago
Description : Organization Portal System developed by WellChoose has an Arbitrary File Reading vulnerability, allowing remote attackers with regular privileges to exploit Absolute Path Traversal to download arbitrary system files.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 09:15:00 GMT

CVE-2025-6184 - Tutor LMS Pro WordPress SQL Injection Vulnerability

CVE ID : CVE-2025-6184
Published : Aug. 13, 2025, 7:15 a.m. | 5 hours, 25 minutes ago
Description : The Tutor LMS Pro – eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter used in the get_submitted_assignments() function in all versions up to, and including, 3.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Tutor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Only the Pro version is affected.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 07:15:00 GMT

CVE-2025-8760 - INSTAR fcgi_server Buffer Overflow Vulnerability

CVE ID : CVE-2025-8760
Published : Aug. 13, 2025, 7:15 a.m. | 5 hours, 25 minutes ago
Description : A vulnerability was identified in INSTAR 2K+ and 4K 3.11.1 Build 1124. This affects the function base64_decode of the component fcgi_server. The manipulation of the argument Authorization leads to buffer overflow. It is possible to initiate the attack remotely.
Severity: 9.8 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 07:15:00 GMT

CVE-2025-8761 - INSTAR Denial of Service Vulnerability in Backend IPC Server

CVE ID : CVE-2025-8761
Published : Aug. 13, 2025, 7:15 a.m. | 5 hours, 25 minutes ago
Description : A vulnerability has been found in INSTAR 2K+ and 4K 3.11.1 Build 1124. This vulnerability affects unknown code of the component Backend IPC Server. The manipulation leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 07:15:00 GMT

CVE-2025-8762 - INSTAR UART Interface Physical Access Control Bypass

CVE ID : CVE-2025-8762
Published : Aug. 13, 2025, 7:15 a.m. | 5 hours, 25 minutes ago
Description : A vulnerability was found in INSTAR 2K+ and 4K 3.11.1 Build 1124. This issue affects some unknown processing of the component UART Interface. The manipulation leads to improper physical access control. It is possible to launch the attack on the physical device. The exploit has been disclosed to the public and may be used.
Severity: 6.8 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 07:15:00 GMT

CVE-2025-6715 - LatePoint WordPress Local File Inclusion Vulnerability

CVE ID : CVE-2025-6715
Published : Aug. 13, 2025, 6:15 a.m. | 6 hours, 25 minutes ago
Description : The LatePoint WordPress plugin before 5.1.94 is vulnerable to Local File Inclusion via the layout parameter. This makes it possible for attackers to include and execute PHP files on the server, allowing the execution of any PHP code in those files.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 06:15:00 GMT

CVE-2025-7384 - "Elementor Forms PHP Object Injection Vulnerability"

CVE ID : CVE-2025-7384
Published : Aug. 13, 2025, 5:15 a.m. | 7 hours, 25 minutes ago
Description : The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.3 via deserialization of untrusted input in the get_lead_detail function. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain in the Contact Form 7 plugin, which is likely to be used alongside, allows attackers to delete arbitrary files, leading to a denial of service or remote code execution when the wp-config.php file is deleted.
Severity: 9.8 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 05:15:00 GMT

CVE-2025-0818 - elFinder WordPress Plugin Directory Traversal Vulnerability

CVE ID : CVE-2025-0818
Published : Aug. 13, 2025, 4:16 a.m. | 8 hours, 24 minutes ago
Description : Several WordPress plugins using elFinder versions 2.1.64 and prior are vulnerable to Directory Traversal in various versions. This makes it possible for unauthenticated attackers to delete arbitrary files. Successful exploitation of this vulnerability requires a site owner to explicitly make an instance of the file manager available to users.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 04:16:00 GMT

CVE-2025-8491 - Easy Restaurant Menu Manager for WordPress CSRF

CVE ID : CVE-2025-8491
Published : Aug. 13, 2025, 4:16 a.m. | 8 hours, 24 minutes ago
Description : The Easy restaurant menu manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.2. This is due to missing or incorrect nonce validation on the nsc_eprm_save_menu() function. This makes it possible for unauthenticated attackers to upload a menu file via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Severity: 4.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 04:16:00 GMT

CVE-2025-8891 - OceanWP Cross-Site Request Forgery (CSRF)

CVE ID : CVE-2025-8891
Published : Aug. 13, 2025, 4:16 a.m. | 8 hours, 24 minutes ago
Description : The OceanWP theme for WordPress is vulnerable to Cross-Site Request Forgery in versions 4.0.9 to 4.1.1. This is due to missing or incorrect nonce validation on the oceanwp_notice_button_click() function. This makes it possible for unauthenticated attackers to install the Ocean Extra plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Severity: 4.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 04:16:00 GMT

CVE-2025-8880 - Google Chrome V8 Race Condition Execution of Arbitrary Code

CVE ID : CVE-2025-8880
Published : Aug. 13, 2025, 3:15 a.m. | 9 hours, 25 minutes ago
Description : Race in V8 in Google Chrome prior to 139.0.7258.127 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 03:15:00 GMT

CVE-2025-8881 - Google Chrome File Picker Cross-Origin Data Leak

CVE ID : CVE-2025-8881
Published : Aug. 13, 2025, 3:15 a.m. | 9 hours, 25 minutes ago
Description : Inappropriate implementation in File Picker in Google Chrome prior to 139.0.7258.127 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 03:15:00 GMT

CVE-2025-8882 - Google Chrome Aura Use-After-Free Vulnerability

CVE ID : CVE-2025-8882
Published : Aug. 13, 2025, 3:15 a.m. | 9 hours, 25 minutes ago
Description : Use after free in Aura in Google Chrome prior to 139.0.7258.127 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 03:15:00 GMT

CVE-2025-8901 - Google Chrome ANGLE Out-of-Bounds Memory Access Vulnerability

CVE ID : CVE-2025-8901
Published : Aug. 13, 2025, 3:15 a.m. | 9 hours, 25 minutes ago
Description : Out of bounds write in ANGLE in Google Chrome prior to 139.0.7258.127 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 03:15:00 GMT

CVE-2025-4410 - Cisco SetupUtility Buffer Overflow Vulnerability

CVE ID : CVE-2025-4410
Published : Aug. 13, 2025, 3:15 a.m. | 9 hours, 6 minutes ago
Description : A buffer overflow vulnerability exists in the module SetupUtility. An attacker with local privileged access can exploit this vulnerability by executeing arbitrary code.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 03:15:00 GMT

CVE-2025-8879 - Google Chrome Heap Buffer Overflow Vulnerability

CVE ID : CVE-2025-8879
Published : Aug. 13, 2025, 3:15 a.m. | 9 hours, 6 minutes ago
Description : Heap buffer overflow in libaom in Google Chrome prior to 139.0.7258.127 allowed a remote attacker to potentially exploit heap corruption via a curated set of gestures. (Chromium security severity: High)
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 03:15:00 GMT

CVE-2025-4276 - Intel UsbCoreDxe SMM Arbitrary Code Execution

CVE ID : CVE-2025-4276
Published : Aug. 13, 2025, 2:15 a.m. | 10 hours, 6 minutes ago
Description : UsbCoreDxe has a vulnerability which can be used to write arbitrary memory inside SMRAM and execute arbitrary code at SMM level.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 02:15:00 GMT

CVE-2025-4277 - Intel Tcg2Smm SMM Execute Code Arbitrary Memory Write

CVE ID : CVE-2025-4277
Published : Aug. 13, 2025, 2:15 a.m. | 10 hours, 6 minutes ago
Description : Tcg2Smm has a vulnerability which can be used to write arbitrary memory inside SMRAM and execute arbitrary code at SMM level.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Wed, 13 Aug 2025 02:15:00 GMT

Fuite de données chez France Link Interactive

ransomware

Wed Aug 13 2025 02:00:00 GMT+0200 (heure d’été d’Europe centrale)

Fuite de données chez Partner Immo

ransomware

Wed Aug 13 2025 02:00:00 GMT+0200 (heure d’été d’Europe centrale)

Fuite de données chez Google

2,25 millions

Wed Aug 13 2025 02:00:00 GMT+0200 (heure d’été d’Europe centrale)

CVE-2025-54232 - Adobe Framemaker Use After Free Vulnerability

CVE ID : CVE-2025-54232
Published : Aug. 12, 2025, 11:15 p.m. | 10 hours, 24 minutes ago
Description : Adobe Framemaker versions 2020.8, 2022.6 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 23:15:00 GMT

CVE-2025-54233 - Adobe Framemaker Out-of-Bounds Read Vulnerability

CVE ID : CVE-2025-54233
Published : Aug. 12, 2025, 11:15 p.m. | 10 hours, 24 minutes ago
Description : Adobe Framemaker versions 2020.8, 2022.6 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Severity: 5.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 23:15:00 GMT

CVE-2025-54238 - Dimension Out-of-Bounds Read Vulnerability

CVE ID : CVE-2025-54238
Published : Aug. 12, 2025, 11:15 p.m. | 10 hours, 24 minutes ago
Description : Dimension versions 4.1.3 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Severity: 5.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 23:15:00 GMT

CVE-2025-8395 - "CVE-xxxx: Apache Struts SQL Injection Vulnerability"

CVE ID : CVE-2025-8395
Published : Aug. 12, 2025, 11:15 p.m. | 10 hours, 24 minutes ago
Description : Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 23:15:00 GMT

CVE-2025-49457 - Zoom Untrusted Search Path Privilege Escalation Vulnerability

CVE ID : CVE-2025-49457
Published : Aug. 12, 2025, 11:15 p.m. | 9 hours, 25 minutes ago
Description : Untrusted search path in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access
Severity: 9.6 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 23:15:00 GMT

CVE-2025-54229 - Adobe Framemaker Use After Free Vulnerability

CVE ID : CVE-2025-54229
Published : Aug. 12, 2025, 11:15 p.m. | 9 hours, 25 minutes ago
Description : Adobe Framemaker versions 2020.8, 2022.6 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 23:15:00 GMT

CVE-2025-54230 - Adobe Framemaker Use-After-Free Vulnerability

CVE ID : CVE-2025-54230
Published : Aug. 12, 2025, 11:15 p.m. | 9 hours, 25 minutes ago
Description : Adobe Framemaker versions 2020.8, 2022.6 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 23:15:00 GMT

CVE-2025-54231 - Adobe Framemaker Use After Free Vulnerability

CVE ID : CVE-2025-54231
Published : Aug. 12, 2025, 11:15 p.m. | 9 hours, 25 minutes ago
Description : Adobe Framemaker versions 2020.8, 2022.6 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 23:15:00 GMT

CVE-2025-49456 - Zoom Windows Installer Race Condition Vulnerability

CVE ID : CVE-2025-49456
Published : Aug. 12, 2025, 11:15 p.m. | 7 hours, 25 minutes ago
Description : Race condition in the installer for certain Zoom Clients for Windows may allow an unauthenticated user to impact application integrity via local access.
Severity: 6.2 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 23:15:00 GMT

CVE-2025-54222 - Substance3D Out-of-Bounds Write Vulnerability

CVE ID : CVE-2025-54222
Published : Aug. 12, 2025, 10:15 p.m. | 8 hours, 25 minutes ago
Description : Substance3D - Stager versions 3.1.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 22:15:00 GMT

CVE-2025-55170 - WeGIA Reflected Cross-Site Scripting Vulnerability

CVE ID : CVE-2025-55170
Published : Aug. 12, 2025, 9:15 p.m. | 9 hours, 25 minutes ago
Description : WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Prior to version 3.4.8, a reflected cross-site scripting (XSS) vulnerability was identified in the /html/alterar_senha.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the verificacao and redir_config parameter. This issue has been patched in version 3.4.8.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 21:15:00 GMT

CVE-2025-55171 - WeGIA Unauthenticated File Deletion Vulnerability

CVE ID : CVE-2025-55171
Published : Aug. 12, 2025, 9:15 p.m. | 9 hours, 25 minutes ago
Description : WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Prior to version 3.4.8, the application does not check authentication at endpoint /html/personalizacao_remover.php allowing anonymous attacker (without login) to delete any Image files at endpoint /html/personalizacao_remover.php by defining imagem_0 as image id to delete. This issue has been patched in version 3.4.8.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 21:15:00 GMT

CVE-2025-55165 - Autocaliweb API Key Exposure

CVE ID : CVE-2025-55165
Published : Aug. 12, 2025, 9:15 p.m. | 9 hours, 6 minutes ago
Description : Autocaliweb is a web app that offers an interface for browsing, reading, and downloading eBooks using a valid Calibre database. Prior to version 0.8.3, the debug pack generated by Autocaliweb can expose sensitive configuration data, including API keys. This occurs because the to_dict() method, used to serialize configuration for the debug pack, doesn't adequately filter out sensitive fields such as API tokens. Users, unaware of the full contents, might share these debug packs, inadvertently leaking their private API keys. This issue has been patched in version 0.8.3.
Severity: 8.2 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 21:15:00 GMT

CVE-2025-54235 - Substance3D Modeler Out-of-Bounds Read Vulnerability

CVE ID : CVE-2025-54235
Published : Aug. 12, 2025, 9:15 p.m. | 7 hours, 25 minutes ago
Description : Substance3D - Modeler versions 1.22.0 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Severity: 5.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 21:15:00 GMT

CVE-2025-54226 - Adobe InDesign Use After Free Vulnerability

CVE ID : CVE-2025-54226
Published : Aug. 12, 2025, 9:15 p.m. | 7 hours, 6 minutes ago
Description : InDesign Desktop versions 20.4, 19.5.4 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 21:15:00 GMT

CVE-2025-54227 - Adobe InDesign Out-of-Bounds Read Vulnerability

CVE ID : CVE-2025-54227
Published : Aug. 12, 2025, 9:15 p.m. | 7 hours, 6 minutes ago
Description : InDesign Desktop versions 20.4, 19.5.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Severity: 5.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 21:15:00 GMT

CVE-2025-54228 - Adobe InDesign Out-of-Bounds Read Vulnerability

CVE ID : CVE-2025-54228
Published : Aug. 12, 2025, 9:15 p.m. | 7 hours, 6 minutes ago
Description : InDesign Desktop versions 20.4, 19.5.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Severity: 5.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 21:15:00 GMT

CVE-2025-54219 - Adobe InCopy Heap-based Buffer Overflow Arbitrary Code Execution

CVE ID : CVE-2025-54219
Published : Aug. 12, 2025, 9:15 p.m. | 5 hours, 24 minutes ago
Description : InCopy versions 20.4, 19.5.4 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 21:15:00 GMT

CVE-2025-54220 - Adobe InCopy Heap-based Buffer Overflow Arbitrary Code Execution

CVE ID : CVE-2025-54220
Published : Aug. 12, 2025, 9:15 p.m. | 5 hours, 24 minutes ago
Description : InCopy versions 20.4, 19.5.4 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 21:15:00 GMT

CVE-2025-54221 - Adobe InCopy Out-of-Bounds Write Arbitrary Code Execution Vulnerability

CVE ID : CVE-2025-54221
Published : Aug. 12, 2025, 9:15 p.m. | 5 hours, 24 minutes ago
Description : InCopy versions 20.4, 19.5.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 21:15:00 GMT

CVE-2025-54223 - Adobe InCopy Use After Free Vulnerability

CVE ID : CVE-2025-54223
Published : Aug. 12, 2025, 9:15 p.m. | 5 hours, 24 minutes ago
Description : InCopy versions 20.4, 19.5.4 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 21:15:00 GMT

CVE-2025-54224 - Adobe InDesign Use After Free Vulnerability

CVE ID : CVE-2025-54224
Published : Aug. 12, 2025, 9:15 p.m. | 5 hours, 24 minutes ago
Description : InDesign Desktop versions 20.4, 19.5.4 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 21:15:00 GMT

CVE-2025-54225 - Adobe InDesign Use After Free Vulnerability (Arbitrary Code Execution)

CVE ID : CVE-2025-54225
Published : Aug. 12, 2025, 9:15 p.m. | 5 hours, 24 minutes ago
Description : InDesign Desktop versions 20.4, 19.5.4 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 21:15:00 GMT

CVE-2025-54217 - Adobe InCopy Heap-based Buffer Overflow Vulnerability

CVE ID : CVE-2025-54217
Published : Aug. 12, 2025, 9:15 p.m. | 3 hours, 24 minutes ago
Description : InCopy versions 20.4, 19.5.4 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 21:15:00 GMT

CVE-2025-54218 - Adobe InCopy Out-of-Bounds Write Arbitrary Code Execution

CVE ID : CVE-2025-54218
Published : Aug. 12, 2025, 9:15 p.m. | 3 hours, 24 minutes ago
Description : InCopy versions 20.4, 19.5.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 21:15:00 GMT

CVE-2025-54208 - Adobe InDesign Out-of-Bounds Write Arbitrary Code Execution Vulnerability

CVE ID : CVE-2025-54208
Published : Aug. 12, 2025, 9:15 p.m. | 1 hour, 24 minutes ago
Description : InDesign Desktop versions 20.4, 19.5.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 21:15:00 GMT

CVE-2025-54209 - Adobe InDesign Heap-based Buffer Overflow Vulnerability

CVE ID : CVE-2025-54209
Published : Aug. 12, 2025, 9:15 p.m. | 1 hour, 24 minutes ago
Description : InDesign Desktop versions 20.4, 19.5.4 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 21:15:00 GMT

CVE-2025-54210 - Adobe InDesign Arbitrary Code Execution Vulnerability

CVE ID : CVE-2025-54210
Published : Aug. 12, 2025, 9:15 p.m. | 1 hour, 24 minutes ago
Description : InDesign Desktop versions 20.4, 19.5.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 21:15:00 GMT

CVE-2025-54211 - Adobe InDesign Heap-based Buffer Overflow Vulnerability

CVE ID : CVE-2025-54211
Published : Aug. 12, 2025, 9:15 p.m. | 1 hour, 24 minutes ago
Description : InDesign Desktop versions 20.4, 19.5.4 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 21:15:00 GMT

CVE-2025-54212 - Adobe InDesign Heap-based Buffer Overflow Vulnerability

CVE ID : CVE-2025-54212
Published : Aug. 12, 2025, 9:15 p.m. | 1 hour, 24 minutes ago
Description : InDesign Desktop versions 20.4, 19.5.4 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 21:15:00 GMT

CVE-2025-54213 - Adobe InDesign Out-of-Bounds Write Arbitrary Code Execution Vulnerability

CVE ID : CVE-2025-54213
Published : Aug. 12, 2025, 9:15 p.m. | 1 hour, 24 minutes ago
Description : InDesign Desktop versions 20.4, 19.5.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 21:15:00 GMT

CVE-2025-54214 - Adobe InDesign Out-of-Bounds Read Vulnerability

CVE ID : CVE-2025-54214
Published : Aug. 12, 2025, 9:15 p.m. | 1 hour, 24 minutes ago
Description : InDesign Desktop versions 20.4, 19.5.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Severity: 5.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 21:15:00 GMT

CVE-2025-54215 - Adobe InCopy Out-of-Bounds Write Vulnerability

CVE ID : CVE-2025-54215
Published : Aug. 12, 2025, 9:15 p.m. | 1 hour, 24 minutes ago
Description : InCopy versions 20.4, 19.5.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 21:15:00 GMT

CVE-2025-54216 - Adobe InCopy Out-of-Bounds Write Arbitrary Code Execution Vulnerability

CVE ID : CVE-2025-54216
Published : Aug. 12, 2025, 9:15 p.m. | 1 hour, 24 minutes ago
Description : InCopy versions 20.4, 19.5.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 21:15:00 GMT

CVE-2025-54207 - Adobe InDesign Uninitialized Pointer Code Execution Vulnerability

CVE ID : CVE-2025-54207
Published : 12 de agosto de 2025 a las 21:15 | 1 hora ago
Description : InDesign Desktop versions 20.4, 19.5.4 and earlier are affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 21:15:00 GMT

CVE-2023-45584 - Fortinet FortiOS Double Free Vulnerability

CVE ID : CVE-2023-45584
Published : Aug. 12, 2025, 7:15 p.m. | 1 hour, 3 minutes ago
Description : A double free vulnerability [CWE-415] in Fortinet FortiOS version 7.4.0, version 7.2.0 through 7.2.5 and before 7.0.12, FortiProxy version 7.4.0 through 7.4.1, version 7.2.0 through 7.2.7 and before 7.0.13 and FortiPAM version 1.1.0 through 1.1.2 and before 1.0.3 allows a privileged attacker to execute code or commands via crafted HTTP or HTTPs requests.
Severity: 6.6 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 19:15:00 GMT

CVE-2024-26009 - Fortinet FortiOS Authentication Bypass via FGFM Requests

CVE ID : CVE-2024-26009
Published : Aug. 12, 2025, 7:15 p.m. | 1 hour, 3 minutes ago
Description : An authentication bypass using an alternate path or channel [CWE-288] vulnerability in Fortinet FortiOS version 6.4.0 through 6.4.15 and before 6.2.16, FortiProxy version 7.4.0 through 7.4.2, 7.2.0 through 7.2.8 and before 7.0.15 & FortiPAM before version 1.2.0 allows an unauthenticated attacker to seize control of a managed device via crafted FGFM requests, if the device is managed by a FortiManager, and if the attacker knows that FortiManager's serial number.
Severity: 8.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 19:15:00 GMT

CVE-2024-40588 - Fortinet FortiMail, FortiVoice, FortiRecorder, FortiCamera, FortiNDR Path Traversal Vulnerability

CVE ID : CVE-2024-40588
Published : Aug. 12, 2025, 7:15 p.m. | 1 hour, 3 minutes ago
Description : Multiple relative path traversal vulnerabilities [CWE-23] in Fortinet FortiMail version 7.6.0 through 7.6.1 and before 7.4.3, FortiVoice version 7.0.0 through 7.0.5 and before 7.4.9, FortiRecorder version 7.2.0 through 7.2.1 and before 7.0.4, FortiCamera & FortiNDR version 7.6.0 and before 7.4.6 may allow a privileged attacker to read files from the underlying filesystem via crafted CLI requests.
Severity: 4.4 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 19:15:00 GMT

CVE-2024-48892 - FortiSOAR Relative Path Traversal Vulnerability

CVE ID : CVE-2024-48892
Published : Aug. 12, 2025, 7:15 p.m. | 1 hour, 3 minutes ago
Description : A relative path traversal vulnerability [CWE-23] in FortiSOAR 7.6.0, 7.5.0 through 7.5.1, 7.4 all versions, 7.3 all versions may allow an authenticated attacker to read arbitrary files via uploading a malicious solution pack.
Severity: 6.8 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 19:15:00 GMT

CVE-2024-52964 - Fortinet FortiManager Path Traversal Vulnerability

CVE ID : CVE-2024-52964
Published : Aug. 12, 2025, 7:15 p.m. | 1 hour, 3 minutes ago
Description : An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] in Fortinet FortiManager version 7.6.0 through 7.6.1, 7.4.0 through 7.4.5, 7.2.0 through 7.2.9 and below 7.0.13 & FortiManager Cloud version 7.6.0 through 7.6.1, 7.4.0 through 7.4.5 and before 7.2.9 allows an authenticated remote attacker to overwrite arbitrary files via FGFM crafted requests.
Severity: 5.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 19:15:00 GMT

CVE-2025-25248 - FortiOS Integer Overflow in SSL-VPN Bookmarks

CVE ID : CVE-2025-25248
Published : Aug. 12, 2025, 7:15 p.m. | 1 hour, 3 minutes ago
Description : An Integer Overflow or Wraparound vulnerability [CWE-190] in FortiOS version 7.6.2 and below, version 7.4.7 and below, version 7.2.10 and below, 7.2 all versions, 6.4 all versions, FortiProxy version 7.6.2 and below, version 7.4.3 and below, 7.2 all versions, 7.0 all versions, 2.0 all versions and FortiPAM version 1.5.0, version 1.4.2 and below, 1.3 all versions, 1.2 all versions, 1.1 all versions, 1.0 all versions SSL-VPN RDP and VNC bookmarks may allow an authenticated user to affect the device SSL-VPN availability via crafted requests.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 19:15:00 GMT

CVE-2025-25256 - Fortinet FortiSIEM OS Command Injection

CVE ID : CVE-2025-25256
Published : Aug. 12, 2025, 7:15 p.m. | 1 hour, 3 minutes ago
Description : An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiSIEM version 7.3.0 through 7.3.1, 7.2.0 through 7.2.5, 7.1.0 through 7.1.7, 7.0.0 through 7.0.3 and before 6.7.9 allows an unauthenticated attacker to execute unauthorized code or commands via crafted CLI requests.
Severity: 9.8 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 19:15:00 GMT

CVE-2025-27759 - Fortinet FortiWeb OS Command Injection

CVE ID : CVE-2025-27759
Published : Aug. 12, 2025, 7:15 p.m. | 1 hour, 3 minutes ago
Description : An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiWeb version 7.6.0 through 7.6.3, 7.4.0 through 7.4.7, 7.2.0 through 7.2.10 and before 7.0.10 allows an authenticated privileged attacker to execute unauthorized code or commands via crafted CLI commands
Severity: 6.7 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 19:15:00 GMT

CVE-2025-32766 - Fortinet FortiWeb Stack-Based Buffer Overflow Vulnerability

CVE ID : CVE-2025-32766
Published : Aug. 12, 2025, 7:15 p.m. | 1 hour, 3 minutes ago
Description : A stack-based buffer overflow vulnerability [CWE-121] in Fortinet FortiWeb CLI version 7.6.0 through 7.6.3 and before 7.4.8 allows a privileged attacker to execute arbitrary code or commands via crafted CLI commands
Severity: 6.4 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 19:15:00 GMT

CVE-2025-32932 - FortiSOAR XSS

CVE ID : CVE-2025-32932
Published : Aug. 12, 2025, 7:15 p.m. | 1 hour, 3 minutes ago
Description : An Improper neutralization of input during web page generation ('cross-site scripting') vulnerability [CWE-79] in FortiSOAR version 7.6.1 and below, version 7.5.1 and below, 7.4 all versions, 7.3 all versions, 7.2 all versions, 7.0 all versions, 6.4 all versions WEB UI may allow an authenticated remote attacker to perform an XSS attack via stored malicious service requests
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 19:15:00 GMT

CVE-2025-36124 - IBM WebSphere Application Server Liberty JMS Message Injection Vulnerability

CVE ID : CVE-2025-36124
Published : Aug. 12, 2025, 7:15 p.m. | 1 hour, 3 minutes ago
Description : IBM WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.8 could allow a remote attacker to bypass security restrictions caused by a failure to honor JMS messaging configuration
Severity: 5.9 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 19:15:00 GMT

CVE-2025-43734 - Liferay Portal Liferay DXP Cross-Site Scripting (XSS) Vulnerability

CVE ID : CVE-2025-43734
Published : Aug. 12, 2025, 7:15 p.m. | 1 hour, 3 minutes ago
Description : A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.10, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows a remote authenticated attacker to inject JavaScript code in the “first display label” field in the configuration of a custom sort widget. This malicious payload is then reflected and executed by clay button taglib when refreshing the page.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 19:15:00 GMT

CVE-2025-47857 - Fortinet FortiWeb OS Command Injection

CVE ID : CVE-2025-47857
Published : Aug. 12, 2025, 7:15 p.m. | 1 hour, 3 minutes ago
Description : A improper neutralization of special elements used in an os command ('os command injection') vulnerability [CWE-78] in Fortinet FortiWeb CLI version 7.6.0 through 7.6.3 and before 7.4.8 allows a privileged attacker to execute arbitrary code or command via crafted CLI commands.
Severity: 6.7 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 19:15:00 GMT

CVE-2025-49813 - Fortinet FortiADC OS Command Injection

CVE ID : CVE-2025-49813
Published : Aug. 12, 2025, 7:15 p.m. | 1 hour, 3 minutes ago
Description : An improper neutralization of special elements used in an OS Command ("OS Command Injection") vulnerability [CWE-78] in Fortinet FortiADC version 7.2.0 and before 7.1.1 allows a remote and authenticated attacker with low privilege to execute unauthorized code via specifically crafted HTTP parameters.
Severity: 7.2 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 19:15:00 GMT

CVE-2025-52970 - Fortinet FortiWeb Unauthenticated Privilege Escalation Vulnerability

CVE ID : CVE-2025-52970
Published : Aug. 12, 2025, 7:15 p.m. | 1 hour, 3 minutes ago
Description : A improper handling of parameters in Fortinet FortiWeb versions 7.6.3 and below, versions 7.4.7 and below, versions 7.2.10 and below, and 7.0.10 and below may allow an unauthenticated remote attacker with non-public information pertaining to the device and targeted user to gain admin privileges on the device via a specially crafted request.
Severity: 8.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 19:15:00 GMT

CVE-2025-53744 - FortiOS Security Fabric Privilege Escalation Vulnerability

CVE ID : CVE-2025-53744
Published : Aug. 12, 2025, 7:15 p.m. | 1 hour, 3 minutes ago
Description : An incorrect privilege assignment vulnerability [CWE-266] in FortiOS Security Fabric version 7.6.0 through 7.6.2, 7.4.0 through 7.4.7, 7.2 all versions, 7.0 all versions, 6.4 all versions, may allow a remote authenticated attacker with high privileges to escalate their privileges to super-admin via registering the device to a malicious FortiManager.
Severity: 7.2 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 19:15:00 GMT

CVE-2025-55168 - WeGIA SQL Injection Vulnerability

CVE ID : CVE-2025-55168
Published : Aug. 12, 2025, 7:15 p.m. | 1 hour, 3 minutes ago
Description : WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Prior to version 3.4.8, a SQL Injection vulnerability was identified in the /html/saude/aplicar_medicamento.php endpoint, specifically in the id_fichamedica parameter. This vulnerability allows attackers to execute arbitrary SQL commands, compromising the confidentiality, integrity, and availability of the database. This issue has been patched in version 3.4.8.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 19:15:00 GMT

CVE-2025-55169 - WeGIA Path Traversal Vulnerability

CVE ID : CVE-2025-55169
Published : Aug. 12, 2025, 7:15 p.m. | 1 hour, 3 minutes ago
Description : WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Prior to version 3.4.8, a path traversal vulnerability was discovered in the WeGIA application, html/socio/sistema/download_remessa.php endpoint. This vulnerability could allow an attacker to gain unauthorized access to local files in the server and sensitive information stored in config.php. config.php contains information that could allow direct access to the database. This issue has been patched in version 3.4.8.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 19:15:00 GMT

CVE-2025-53779 - Microsoft Windows Kerberos Path Traversal Privilege Escalation

CVE ID : CVE-2025-53779
Published : Aug. 12, 2025, 6:15 p.m. | 2 hours, 2 minutes ago
Description : Relative path traversal in Windows Kerberos allows an authorized attacker to elevate privileges over a network.
Severity: 7.2 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 18:15:00 GMT

CVE-2025-53781 - Azure Virtual Machines Information Exposure Vulnerability

CVE ID : CVE-2025-53781
Published : Aug. 12, 2025, 6:15 p.m. | 2 hours, 2 minutes ago
Description : Exposure of sensitive information to an unauthorized actor in Azure Virtual Machines allows an authorized attacker to disclose information over a network.
Severity: 7.7 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 18:15:00 GMT

CVE-2025-53783 - Microsoft Teams Heap Buffer Overflow Remote Code Execution Vulnerability

CVE ID : CVE-2025-53783
Published : Aug. 12, 2025, 6:15 p.m. | 2 hours, 2 minutes ago
Description : Heap-based buffer overflow in Microsoft Teams allows an unauthorized attacker to execute code over a network.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 18:15:00 GMT

CVE-2025-53784 - Microsoft Office Word Use After Free Remote Code Execution Vulnerability

CVE ID : CVE-2025-53784
Published : Aug. 12, 2025, 6:15 p.m. | 2 hours, 2 minutes ago
Description : Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
Severity: 8.4 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 18:15:00 GMT

CVE-2025-53788 - Windows Subsystem for Linux TOCTOU Privilege Escalation

CVE ID : CVE-2025-53788
Published : Aug. 12, 2025, 6:15 p.m. | 2 hours, 2 minutes ago
Description : Time-of-check time-of-use (toctou) race condition in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.
Severity: 7.0 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 18:15:00 GMT

CVE-2025-53789 - Windows StateRepository API Local Privilege Escalation

CVE ID : CVE-2025-53789
Published : Aug. 12, 2025, 6:15 p.m. | 2 hours, 2 minutes ago
Description : Missing authentication for critical function in Windows StateRepository API allows an authorized attacker to elevate privileges locally.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 18:15:00 GMT

CVE-2025-53793 - Azure Stack Authentication Bypass

CVE ID : CVE-2025-53793
Published : Aug. 12, 2025, 6:15 p.m. | 2 hours, 2 minutes ago
Description : Improper authentication in Azure Stack allows an unauthorized attacker to disclose information over a network.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 18:15:00 GMT

CVE-2025-53733 - Microsoft Office Word Integer Overflow Remote Code Execution Vulnerability

CVE ID : CVE-2025-53733
Published : Aug. 12, 2025, 6:15 p.m. | 23 minutes ago
Description : Incorrect conversion between numeric types in Microsoft Office Word allows an unauthorized attacker to execute code locally.
Severity: 8.4 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 18:15:00 GMT

CVE-2025-53734 - Microsoft Office Visio Use-After-Free Remote Code Execution Vulnerability

CVE ID : CVE-2025-53734
Published : Aug. 12, 2025, 6:15 p.m. | 23 minutes ago
Description : Use after free in Microsoft Office Visio allows an unauthorized attacker to execute code locally.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 18:15:00 GMT

CVE-2025-53735 - Microsoft Office Excel Use-After-Free Vulnerability

CVE ID : CVE-2025-53735
Published : Aug. 12, 2025, 6:15 p.m. | 23 minutes ago
Description : Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 18:15:00 GMT

CVE-2025-53736 - Microsoft Office Word Buffer Over-Read Information Disclosure

CVE ID : CVE-2025-53736
Published : Aug. 12, 2025, 6:15 p.m. | 23 minutes ago
Description : Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
Severity: 6.8 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 18:15:00 GMT

CVE-2025-53737 - Microsoft Office Excel Heap-Based Buffer Overflow Vulnerability

CVE ID : CVE-2025-53737
Published : Aug. 12, 2025, 6:15 p.m. | 23 minutes ago
Description : Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 18:15:00 GMT

CVE-2025-53738 - Microsoft Office Word Use After Free Code Execution Vulnerability

CVE ID : CVE-2025-53738
Published : Aug. 12, 2025, 6:15 p.m. | 23 minutes ago
Description : Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 18:15:00 GMT

CVE-2025-53739 - Microsoft Office Excel Type Confusion Code Execution Vulnerability

CVE ID : CVE-2025-53739
Published : Aug. 12, 2025, 6:15 p.m. | 23 minutes ago
Description : Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 18:15:00 GMT

CVE-2025-53740 - Microsoft Office Use-After-Free Code Execution Vulnerability

CVE ID : CVE-2025-53740
Published : Aug. 12, 2025, 6:15 p.m. | 23 minutes ago
Description : Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
Severity: 8.4 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 18:15:00 GMT

CVE-2025-53741 - Microsoft Office Excel Heap-Based Buffer Overflow Vulnerability

CVE ID : CVE-2025-53741
Published : Aug. 12, 2025, 6:15 p.m. | 23 minutes ago
Description : Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 18:15:00 GMT

CVE-2025-53759 - Microsoft Office Excel Uninitialized Resource Code Execution Vulnerability

CVE ID : CVE-2025-53759
Published : Aug. 12, 2025, 6:15 p.m. | 23 minutes ago
Description : Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 18:15:00 GMT

CVE-2025-53760 - Microsoft Office SharePoint SSRF

CVE ID : CVE-2025-53760
Published : Aug. 12, 2025, 6:15 p.m. | 23 minutes ago
Description : Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
Severity: 7.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 18:15:00 GMT

CVE-2025-53761 - Microsoft Office PowerPoint Use-After-Free Remote Code Execution Vulnerability

CVE ID : CVE-2025-53761
Published : Aug. 12, 2025, 6:15 p.m. | 23 minutes ago
Description : Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 18:15:00 GMT

CVE-2025-53765 - Azure Stack Information Disclosure Vulnerability

CVE ID : CVE-2025-53765
Published : Aug. 12, 2025, 6:15 p.m. | 23 minutes ago
Description : Exposure of private personal information to an unauthorized actor in Azure Stack allows an authorized attacker to disclose information locally.
Severity: 4.4 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 18:15:00 GMT

CVE-2025-53766 - Windows GDI+ Heap-based Buffer Overflow

CVE ID : CVE-2025-53766
Published : Aug. 12, 2025, 6:15 p.m. | 23 minutes ago
Description : Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network.
Severity: 9.8 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 18:15:00 GMT

CVE-2025-53769 - Windows Security App Path Traversal Vulnerability

CVE ID : CVE-2025-53769
Published : Aug. 12, 2025, 6:15 p.m. | 23 minutes ago
Description : External control of file name or path in Windows Security App allows an authorized attacker to perform spoofing locally.
Severity: 5.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 18:15:00 GMT

CVE-2025-53772 - Web Deploy Untrusted Data Deserialization Code Execution Vulnerability

CVE ID : CVE-2025-53772
Published : Aug. 12, 2025, 6:15 p.m. | 23 minutes ago
Description : Deserialization of untrusted data in Web Deploy allows an authorized attacker to execute code over a network.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 18:15:00 GMT

CVE-2025-53773 - GitHub Copilot Command Injection Vulnerability

CVE ID : CVE-2025-53773
Published : Aug. 12, 2025, 6:15 p.m. | 23 minutes ago
Description : Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to execute code locally.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 18:15:00 GMT

CVE-2025-53778 - Microsoft Windows NTLM Privilege Escalation

CVE ID : CVE-2025-53778
Published : Aug. 12, 2025, 6:15 p.m. | 23 minutes ago
Description : Improper authentication in Windows NTLM allows an authorized attacker to elevate privileges over a network.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 18:15:00 GMT

CVE-2025-24835 - Intel Arc B-Series Graphics Denial of Service Vulnerability

CVE ID : CVE-2025-24835
Published : Aug. 12, 2025, 5:15 p.m. | 58 minutes ago
Description : Protection mechanism failure in the Intel(R) Graphics Driver for the Intel(R) Arc(TM) B-Series graphics before version 32.0.101.6737 may allow an authenticated user to potentially enable denial of service via local access.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 17:15:00 GMT

CVE-2025-24840 - Intel Tiber Edge Platform Privilege Escalation Vulnerability

CVE ID : CVE-2025-24840
Published : Aug. 12, 2025, 5:15 p.m. | 58 minutes ago
Description : Improper access control for some Edge Orchestrator software before version 24.11.1 for Intel(R) Tiber(TM) Edge Platform may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.
Severity: 5.8 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 17:15:00 GMT

CVE-2025-24921 - Intel Tiber Edge Orchestrator Improper Neutralization Information Disclosure

CVE ID : CVE-2025-24921
Published : Aug. 12, 2025, 5:15 p.m. | 58 minutes ago
Description : Improper neutralization for some Edge Orchestrator software before version 24.11.1 for Intel(R) Tiber(TM) Edge Platform may allow an unauthenticated user to potentially enable information disclosure via adjacent access.
Severity: 6.6 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 17:15:00 GMT

CVE-2025-24923 - "Intel AI for Enterprise Retrieval-augmented Generation Uncontrolled Search Path Vulnerability (EoP)"

CVE ID : CVE-2025-24923
Published : Aug. 12, 2025, 5:15 p.m. | 58 minutes ago
Description : Uncontrolled search path in some Intel(R) AI for Enterprise Retrieval-augmented Generation software may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: 6.7 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 17:15:00 GMT

CVE-2025-25273 - Intel 700 Series Ethernet Kernel Mode Driver Control Flow Vulnerability

CVE ID : CVE-2025-25273
Published : Aug. 12, 2025, 5:15 p.m. | 58 minutes ago
Description : Insufficient control flow management in the Linux kernel-mode driver for some Intel(R) 700 Series Ethernet before version 2.28.5 may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 17:15:00 GMT

CVE-2025-26403 - Intel Xeon SGX/TDX OOB Write Privilege Escalation

CVE ID : CVE-2025-26403
Published : Aug. 12, 2025, 5:15 p.m. | 58 minutes ago
Description : Out-of-bounds write in the memory subsystem for some Intel(R) Xeon(R) 6 processors when using Intel(R) SGX or Intel(R) TDX may allow a privileged user to potentially enable escalation of privilege via local access.
Severity: 7.2 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 17:15:00 GMT

CVE-2025-26404 - Intel DSA Uncontrolled Search Path Privilege Escalation

CVE ID : CVE-2025-26404
Published : Aug. 12, 2025, 5:15 p.m. | 58 minutes ago
Description : Uncontrolled search path for some Intel(R) DSA software before version 25.2.15.9 may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: 6.7 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 17:15:00 GMT

CVE-2025-26470 - Intel Distribution for Python Unprivileged Privilege Escalation

CVE ID : CVE-2025-26470
Published : Aug. 12, 2025, 5:15 p.m. | 58 minutes ago
Description : Incorrect default permissions for some Intel(R) Distribution for Python software installers before version 2025.1.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: 6.7 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 17:15:00 GMT

CVE-2025-26472 - Intel Tiber Edge Platform Denial of Service

CVE ID : CVE-2025-26472
Published : Aug. 12, 2025, 5:15 p.m. | 58 minutes ago
Description : Uncontrolled resource consumption for some Edge Orchestrator software before version 24.11.1 for Intel(R) Tiber(TM) Edge Platform may allow an authenticated user to potentially enable denial of service via adjacent access.
Severity: 5.7 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 17:15:00 GMT

CVE-2025-26697 - Intel 700 Series Ethernet Unauthenticated Denial of Service

CVE ID : CVE-2025-26697
Published : Aug. 12, 2025, 5:15 p.m. | 58 minutes ago
Description : Uncontrolled resource consumption in the Linux kernel-mode driver for some Intel(R) 700 Series Ethernet before version 2.28.5 may allow an authenticated user to potentially enable denial of service.
Severity: 3.3 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 17:15:00 GMT

CVE-2025-26863 - Intel 700 Series Ethernet Denial of Service

CVE ID : CVE-2025-26863
Published : Aug. 12, 2025, 5:15 p.m. | 58 minutes ago
Description : Uncontrolled resource consumption in the Linux kernel-mode driver for some Intel(R) 700 Series Ethernet before version 2.28.5 may allow an authenticated user to potentially enable denial of service.
Severity: 3.8 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 17:15:00 GMT

CVE-2025-27250 - Intel Tiber Edge Platform Denial of Service

CVE ID : CVE-2025-27250
Published : Aug. 12, 2025, 5:15 p.m. | 58 minutes ago
Description : Uncontrolled resource consumption for some Edge Orchestrator software before version 24.11.1 for Intel(R) Tiber(TM) Edge Platform may allow an authenticated user to potentially enable denial of service via adjacent access.
Severity: 3.5 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 17:15:00 GMT

CVE-2025-27537 - Intel Tiber Edge Platform Privilege Escalation Vulnerability

CVE ID : CVE-2025-27537
Published : Aug. 12, 2025, 5:15 p.m. | 58 minutes ago
Description : Improper input validation for some Edge Orchestrator software before version 24.11.1 for Intel(R) Tiber(TM) Edge Platform may allow an authenticated user to potentially enable escalation of privilege via adjacent access.
Severity: 5.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 17:15:00 GMT

CVE-2025-27559 - Apache AI Playground Privilege Escalation

CVE ID : CVE-2025-27559
Published : Aug. 12, 2025, 5:15 p.m. | 58 minutes ago
Description : Incorrect default permissions for some AI Playground software before version v2.3.0 alpha may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: 6.7 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 17:15:00 GMT

CVE-2025-27576 - Intel Tiber Edge Platform Unauthenticated Denial of Service Vulnerability

CVE ID : CVE-2025-27576
Published : Aug. 12, 2025, 5:15 p.m. | 58 minutes ago
Description : Uncontrolled resource consumption for some Edge Orchestrator software before version 24.11.1 for Intel(R) Tiber(TM) Edge Platform may allow an unauthenticated user to potentially enable denial of service via local access.
Severity: 2.9 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 17:15:00 GMT

CVE-2025-27707 - Intel Tiber Edge Orchestrator Sensitive Information Exposure Denial of Service

CVE ID : CVE-2025-27707
Published : Aug. 12, 2025, 5:15 p.m. | 58 minutes ago
Description : Exposure of sensitive information to an unauthorized actor for some Edge Orchestrator software before version 24.11.1 for Intel(R) Tiber(TM) Edge Platform may allow an authenticated user to potentially enable denial of service via adjacent access.
Severity: 2.6 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 17:15:00 GMT

CVE-2025-27717 - Intel Graphics Driver Uncontrolled Search Path Privilege Escalation

CVE ID : CVE-2025-27717
Published : Aug. 12, 2025, 5:15 p.m. | 58 minutes ago
Description : Uncontrolled search path for some Intel(R) Graphics Driver software may allow an authenticated user to potentially enable escalation of privilege via local access
Severity: 6.7 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 17:15:00 GMT

CVE-2025-32004 - Intel Edger8r Tool SGX SDK Privilege Escalation Vulnerability

CVE ID : CVE-2025-32004
Published : Aug. 12, 2025, 5:15 p.m. | 58 minutes ago
Description : Improper input validation in the Intel Edger8r Tool for some Intel(R) SGX SDK may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: 3.9 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 17:15:00 GMT

CVE-2025-32086 - Intel Xeon 6 Processors SGX/TDX Privilege Escalation Vulnerability

CVE ID : CVE-2025-32086
Published : Aug. 12, 2025, 5:15 p.m. | 58 minutes ago
Description : Improperly implemented security check for standard in the DDRIO configuration for some Intel(R) Xeon(R) 6 Processors when using Intel(R) SGX or Intel(R) TDX may allow a privileged user to potentially enable escalation of privilege via local access.
Severity: 7.2 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 17:15:00 GMT

CVE-2025-49563 - Adobe Illustrator Out-of-Bounds Write Vulnerability

CVE ID : CVE-2025-49563
Published : Aug. 12, 2025, 5:15 p.m. | 58 minutes ago
Description : Illustrator versions 28.7.8, 29.6.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 17:15:00 GMT

CVE-2025-49564 - Adobe Illustrator Stack-based Buffer Overflow Vulnerability

CVE ID : CVE-2025-49564
Published : Aug. 12, 2025, 5:15 p.m. | 58 minutes ago
Description : Illustrator versions 28.7.8, 29.6.1 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 17:15:00 GMT

CVE-2025-49567 - Adobe Illustrator NULL Pointer Dereference Denial of Service

CVE ID : CVE-2025-49567
Published : Aug. 12, 2025, 5:15 p.m. | 58 minutes ago
Description : Illustrator versions 28.7.8, 29.6.1 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to crash the application, causing a disruption in service. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Severity: 5.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 17:15:00 GMT

CVE-2025-49568 - Adobe Illustrator Use After Free Vulnerability

CVE ID : CVE-2025-49568
Published : Aug. 12, 2025, 5:15 p.m. | 58 minutes ago
Description : Illustrator versions 28.7.8, 29.6.1 and earlier are affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Severity: 5.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 17:15:00 GMT

CVE-2025-55166 - Savg-sanitizer Cross-Site Scripting and External Domain Linking Vulnerability

CVE ID : CVE-2025-55166
Published : Aug. 12, 2025, 5:15 p.m. | 58 minutes ago
Description : savg-sanitizer is a PHP SVG/XML sanitizer. Prior to version 0.22.0, the sanitization logic in the cleanXlinkHrefs method only searches for lower-case attribute name, which allows to by-pass the isHrefSafeValue check. As a result this allows cross-site scripting or linking to external domains. This issue has been patched in version 0.22.0.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 17:15:00 GMT

CVE-2025-55167 - WeGIA SQL Injection

CVE ID : CVE-2025-55167
Published : Aug. 12, 2025, 5:15 p.m. | 58 minutes ago
Description : WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Prior to version 3.4.8, a SQL Injection vulnerability was identified in the /html/funcionario/dependente_remover.php endpoint, specifically in the id_dependente parameter. This vulnerability allows attackers to execute arbitrary SQL commands, compromising the confidentiality, integrity, and availability of the database. This issue has been patched in version 3.4.8.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 17:15:00 GMT

CVE-2025-38500 - Linux Kernel xfrm Interface Use-After-Free Vulnerability

CVE ID : CVE-2025-38500
Published : Aug. 12, 2025, 4:15 p.m. | 1 hour, 10 minutes ago
Description : In the Linux kernel, the following vulnerability has been resolved: xfrm: interface: fix use-after-free after changing collect_md xfrm interface collect_md property on xfrm interfaces can only be set on device creation, thus xfrmi_changelink() should fail when called on such interfaces. The check to enforce this was done only in the case where the xi was returned from xfrmi_locate() which doesn't look for the collect_md interface, and thus the validation was never reached. Calling changelink would thus errornously place the special interface xi in the xfrmi_net->xfrmi hash, but since it also exists in the xfrmi_net->collect_md_xfrmi pointer it would lead to a double free when the net namespace was taken down [1]. Change the check to use the xi from netdev_priv which is available earlier in the function to prevent changes in xfrm collect_md interfaces. [1] resulting oops: [ 8.516540] kernel BUG at net/core/dev.c:12029! [ 8.516552] Oops: invalid opcode: 0000 [#1] SMP NOPTI [ 8.516559] CPU: 0 UID: 0 PID: 12 Comm: kworker/u80:0 Not tainted 6.15.0-virtme #5 PREEMPT(voluntary) [ 8.516565] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 8.516569] Workqueue: netns cleanup_net [ 8.516579] RIP: 0010:unregister_netdevice_many_notify+0x101/0xab0 [ 8.516590] Code: 90 0f 0b 90 48 8b b0 78 01 00 00 48 8b 90 80 01 00 00 48 89 56 08 48 89 32 4c 89 80 78 01 00 00 48 89 b8 80 01 00 00 eb ac 90 <0f> 0b 48 8b 45 00 4c 8d a0 88 fe ff ff 48 39 c5 74 5c 41 80 bc 24 [ 8.516593] RSP: 0018:ffffa93b8006bd30 EFLAGS: 00010206 [ 8.516598] RAX: ffff98fe4226e000 RBX: ffffa93b8006bd58 RCX: ffffa93b8006bc60 [ 8.516601] RDX: 0000000000000004 RSI: 0000000000000000 RDI: dead000000000122 [ 8.516603] RBP: ffffa93b8006bdd8 R08: dead000000000100 R09: ffff98fe4133c100 [ 8.516605] R10: 0000000000000000 R11: 00000000000003d2 R12: ffffa93b8006be00 [ 8.516608] R13: ffffffff96c1a510 R14: ffffffff96c1a510 R15: ffffa93b8006be00 [ 8.516615] FS: 0000000000000000(0000) GS:ffff98fee73b7000(0000) knlGS:0000000000000000 [ 8.516619] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 8.516622] CR2: 00007fcd2abd0700 CR3: 000000003aa40000 CR4: 0000000000752ef0 [ 8.516625] PKRU: 55555554 [ 8.516627] Call Trace: [ 8.516632] [ 8.516635] ? rtnl_is_locked+0x15/0x20 [ 8.516641] ? unregister_netdevice_queue+0x29/0xf0 [ 8.516650] ops_undo_list+0x1f2/0x220 [ 8.516659] cleanup_net+0x1ad/0x2e0 [ 8.516664] process_one_work+0x160/0x380 [ 8.516673] worker_thread+0x2aa/0x3c0 [ 8.516679] ? __pfx_worker_thread+0x10/0x10 [ 8.516686] kthread+0xfb/0x200 [ 8.516690] ? __pfx_kthread+0x10/0x10 [ 8.516693] ? __pfx_kthread+0x10/0x10 [ 8.516697] ret_from_fork+0x82/0xf0 [ 8.516705] ? __pfx_kthread+0x10/0x10 [ 8.516709] ret_from_fork_asm+0x1a/0x30 [ 8.516718]
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 16:15:00 GMT

CVE-2025-3089 - ServiceNow AI Platform Broken Access Control Vulnerability

CVE ID : CVE-2025-3089
Published : Aug. 12, 2025, 4:15 p.m. | 1 hour, 10 minutes ago
Description : ServiceNow has addressed a Broken Access Control vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could allow a low privileged user to bypass access controls and perform a limited set of actions typically reserved for higher privileged users, potentially leading to unauthorized data modifications. This issue is addressed in the listed patches and family releases, which have been made available to hosted and self-hosted customers, as well as partners.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 16:15:00 GMT

CVE-2025-54800 - Hydra JavaScript Injection Vulnerability

CVE ID : CVE-2025-54800
Published : Aug. 12, 2025, 4:15 p.m. | 1 hour, 10 minutes ago
Description : Hydra is a continuous integration service for Nix based projects. Prior to commit dea1e16, a malicious package can introduce arbitrary JavaScript code into the Hydra database that is automatically evaluated in a client's browser when anyone visits the build page. This could be done by a third-party project as part of its build process. This also happens in other places like with hydra-release-name. This issue has been patched by commit dea1e16. A workaround involves either not building untrusted packages or not visiting the builds page.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 16:15:00 GMT

CVE-2025-54864 - Hydra Unauthenticated API Calls Vulnerability

CVE ID : CVE-2025-54864
Published : Aug. 12, 2025, 4:15 p.m. | 1 hour, 10 minutes ago
Description : Hydra is a continuous integration service for Nix based projects. Prior to commit f7bda02, /api/push-github and /api/push-gitea are called by the corresponding forge without HTTP Basic authentication. Both forges do however feature HMAC signing with a secret key. Triggering an evaluation can be very taxing on the infrastructure when large evaluations are done, introducing potential denial of service attacks on the host running the evaluator. This issue has been patched by commit f7bda02. A workaround involves blocking /api/push-github and /api/push-gitea via a reverse proxy.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 16:15:00 GMT

CVE-2025-55010 - Kanboard PHP Deserialization RCE Vulnerability

CVE ID : CVE-2025-55010
Published : Aug. 12, 2025, 4:15 p.m. | 1 hour, 10 minutes ago
Description : Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.47, an unsafe deserialization vulnerability in the ProjectEventActvityFormatter allows admin users the ability to instantiate arbitrary php objects by modifying the event["data"] field in the project_activities table. A malicious actor can update this field to use a php gadget to write a web shell into the /plugins folder, which then gives remote code execution on the host system. This issue has been patched in version 1.2.47.
Severity: 9.1 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 16:15:00 GMT

CVE-2025-55011 - Kanboard File Traversal Vulnerability

CVE ID : CVE-2025-55011
Published : Aug. 12, 2025, 4:15 p.m. | 1 hour, 10 minutes ago
Description : Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.47, the createTaskFile method in the API does not validate whether the task_id parameter is a valid task id, nor does it check for path traversal. As a result, a malicious actor could write a file anywhere on the system the app user controls. The impact is limited due to the filename being hashed and having no extension. This issue has been patched in version 1.2.47.
Severity: 6.4 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 16:15:00 GMT

CVE-2025-55164 - "Prototype Pollution in Apache Content-Security-Policy-Parser"

CVE ID : CVE-2025-55164
Published : Aug. 12, 2025, 4:15 p.m. | 1 hour, 10 minutes ago
Description : content-security-policy-parser parses content security policy directives. A prototype pollution vulnerability exists in versions 0.5.0 and earlier, wherein if a policy name is called __proto__, one can override the Object prototype. This issue has been patched in version 0.6.0. A workaround involves disabling prototype method in NodeJS, neutralizing all possible prototype pollution attacks. Provide either --disable-proto=delete (recommended) or --disable-proto=throw as an argument to node to enable this feature.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 16:15:00 GMT

CVE-2025-8452 - Brother Multi-Function Printer Serial Number Disclosure and Default Administrator Password Calculation Vulnerability

CVE ID : CVE-2025-8452
Published : Aug. 12, 2025, 4:15 p.m. | 1 hour, 10 minutes ago
Description : By using the "uscan" protocol provided by the eSCL specification, an attacker can discover the serial number of multi-function printers that implement the Brother-provided firmware. This serial number can, in turn, can be leveraged by the flaw described by CVE-2024-51978 to calculate the default administrator password. This flaw is similar to CVE-2024-51977, with the only difference being the protocol by which an attacker can use to learn the remote device's serial number. The eSCL/uscan vector is typically only exposed on the local network. Any discovery service that implements the eSCL specification can be used to exploit this vulnerability, and one such implementation is the runZero Explorer. Changing the default administrator password will render this vulnerability virtually worthless, since the calculated default administrator password would no longer be the correct password.
Severity: 4.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 16:15:00 GMT

CVE-2024-38805 - EDK2 BIOS Integer Overflow Denial of Service Vulnerability

CVE ID : CVE-2024-38805
Published : Aug. 12, 2025, 3:15 p.m. | 2 hours, 10 minutes ago
Description : EDK2 contains a vulnerability in BIOS where a user may cause an Integer Overflow or Wraparound by network means. A successful exploitation of this vulnerability may lead to denial of service.
Severity: 6.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 15:15:00 GMT

CVE-2025-3831 - Harmony SASE Agent Unsecured Log Upload

CVE ID : CVE-2025-3831
Published : Aug. 12, 2025, 3:15 p.m. | 2 hours, 10 minutes ago
Description : Log files uploaded during troubleshooting by the Harmony SASE agent may have been accessible to unauthorized parties.
Severity: 8.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 15:15:00 GMT

CVE-2025-5456 - Ivanti Connect Secure Buffer Over-read DOS Vulnerability

CVE ID : CVE-2025-5456
Published : Aug. 12, 2025, 3:15 p.m. | 2 hours, 10 minutes ago
Description : A buffer over-read vulnerability in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote unauthenticated attacker to trigger a denial of service. CWE-125
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 15:15:00 GMT

CVE-2025-5462 - Ivanti Connect Secure Heap Buffer Overflow Vulnerability

CVE ID : CVE-2025-5462
Published : Aug. 12, 2025, 3:15 p.m. | 2 hours, 10 minutes ago
Description : A heap-based buffer overflow in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote unauthenticated attacker to trigger a denial of service.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 15:15:00 GMT

CVE-2025-5466 - "Ivanti Connect Secure and Ivanti Policy Secure Denial of Service Vulnerability"

CVE ID : CVE-2025-5466
Published : Aug. 12, 2025, 3:15 p.m. | 2 hours, 10 minutes ago
Description : XEE in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with admin privileges to trigger a denial of service
Severity: 4.9 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 15:15:00 GMT

CVE-2025-5468 - Ivanti Connect Secure, Policy Secure, ZTA Gateway, Neurons for Secure Access Local File Reading via Symbolic Link Vulnerability

CVE ID : CVE-2025-5468
Published : Aug. 12, 2025, 3:15 p.m. | 2 hours, 10 minutes ago
Description : Improper handling of symbolic links in Ivanti Connect Secure before version 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a local authenticated attacker to read arbitrary files on disk.
Severity: 5.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 15:15:00 GMT

CVE-2025-8296 - Ivanti Avalanche SQL Injection Remote Code Execution Vulnerability

CVE ID : CVE-2025-8296
Published : Aug. 12, 2025, 3:15 p.m. | 2 hours, 10 minutes ago
Description : SQL injection in Ivanti Avalanche before version 6.4.8.8008 allows a remote authenticated attacker with admin privileges to execute arbitrary SQL queries. In certain conditions, this can also lead to remote code execution
Severity: 7.2 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 15:15:00 GMT

CVE-2025-8297 - Ivanti Avalanche Remote Code Execution

CVE ID : CVE-2025-8297
Published : Aug. 12, 2025, 3:15 p.m. | 2 hours, 10 minutes ago
Description : Incomplete restriction of configuration in Ivanti Avalanche before version 6.4.8.8008 allows a remote authenticated attacker with admin privileges to achieve remote code execution
Severity: 7.2 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 15:15:00 GMT

CVE-2025-8310 - Ivanti Virtual Application Delivery Controller Authentication Bypass

CVE ID : CVE-2025-8310
Published : Aug. 12, 2025, 3:15 p.m. | 2 hours, 10 minutes ago
Description : Missing authorization in the admin console of Ivanti Virtual Application Delivery Controller before version 22.9 allows a remote authenticated attacker to take over admin accounts by resetting the password
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 15:15:00 GMT

CVE-2025-22830 - APTIOV BIOS Race Condition Vulnerability

CVE ID : CVE-2025-22830
Published : Aug. 12, 2025, 2:15 p.m. | 3 hours, 10 minutes ago
Description : APTIOV contains a vulnerability in BIOS where a skilled user may cause “Race Condition” by local access. A successful exploitation of this vulnerability may lead to resource exhaustion and impact Confidentiality, Integrity, and Availability.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 14:15:00 GMT

CVE-2025-22834 - AMI APTIOV BIOS Improper Initialization Vulnerability

CVE ID : CVE-2025-22834
Published : Aug. 12, 2025, 2:15 p.m. | 3 hours, 10 minutes ago
Description : AMI APTIOV contains a vulnerability in BIOS where a user may cause “Improper Initialization” by local accessing. Successful exploitation of this vulnerability may leave the resource in an unexpected state and potentially impact confidentiality, integrity, and availability.
Severity: 4.2 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 14:15:00 GMT

CVE-2025-43735 - Liferay Portal Liferay DXP Cross-Site Scripting (XSS)

CVE ID : CVE-2025-43735
Published : Aug. 12, 2025, 1:15 p.m. | 4 hours, 10 minutes ago
Description : A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the google_gadget.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 13:15:00 GMT

CVE-2025-40766 - SINEC Traffic Analyzer Docker DoS Vulnerability

CVE ID : CVE-2025-40766
Published : Aug. 12, 2025, 12:15 p.m. | 5 hours, 10 minutes ago
Description : A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V3.0). The affected application runs docker containers without adequate resource and security limitations. This could allow an attacker to perform a denial-of-service (DoS) attack.
Severity: 5.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 12:15:00 GMT

CVE-2025-40767 - SINEC Traffic Analyzer Docker Container Isolation Bypass

CVE ID : CVE-2025-40767
Published : Aug. 12, 2025, 12:15 p.m. | 5 hours, 10 minutes ago
Description : A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V3.0). The affected application runs docker containers without adequate security controls to enforce isolation. This could allow an attacker to gain elevated access, potentially accessing sensitive host system resources.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 12:15:00 GMT

CVE-2025-40768 - SINEC Traffic Analyzer Remote Service Access Vulnerability

CVE ID : CVE-2025-40768
Published : Aug. 12, 2025, 12:15 p.m. | 5 hours, 10 minutes ago
Description : A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V3.0). The affected application exposes an internal service port to be accessible from outside the system. This could allow an unauthorized attacker to access the application.
Severity: 7.3 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 12:15:00 GMT

CVE-2025-40769 - SINEC Traffic Analyzer Cross-Site Scripting Vulnerability

CVE ID : CVE-2025-40769
Published : Aug. 12, 2025, 12:15 p.m. | 5 hours, 10 minutes ago
Description : A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V3.0). The affected application uses a Content Security Policy that allows unsafe script execution methods. This could allow an attacker to execute unauthorized scripts, potentially leading to cross-site scripting attacks.
Severity: 7.4 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 12:15:00 GMT

CVE-2025-40770 - SINEC Traffic Analyzer Man-in-the-Middle Vulnerability

CVE ID : CVE-2025-40770
Published : Aug. 12, 2025, 12:15 p.m. | 5 hours, 10 minutes ago
Description : A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions). The affected application uses a monitoring interface that is not operating in a strictly passive mode. This could allow an attacker to interact with the interface, leading to man-in-the-middle attacks.
Severity: 7.4 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 12:15:00 GMT

CVE-2024-41986 - Siemens Opcenter QL Home, SOA Audit, and SOA Cockpit TLS Insecure Protocol Vulnerability

CVE ID : CVE-2024-41986
Published : Aug. 12, 2025, 12:15 p.m. | 3 hours, 13 minutes ago
Description : A vulnerability has been identified in SmartClient modules Opcenter QL Home (SC) (All versions >= V13.2 < V2506), SOA Audit (All versions >= V13.2 < V2506), SOA Cockpit (All versions >= V13.2 < V2506). The affected application support insecure TLS 1.0 and 1.1 protocol. An attacker could achieve a man-in-the-middle attack and compromise confidentiality and integrity of data.
Severity: 6.4 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 12:15:00 GMT

CVE-2024-52504 - Siemens SIPROTEC 4 Remote File Transfer Denial of Service

CVE ID : CVE-2024-52504
Published : Aug. 12, 2025, 12:15 p.m. | 3 hours, 13 minutes ago
Description : A vulnerability has been identified in SIPROTEC 4 6MD61 (All versions), SIPROTEC 4 6MD63 (All versions), SIPROTEC 4 6MD66 (All versions), SIPROTEC 4 6MD665 (All versions), SIPROTEC 4 7SA522 (All versions), SIPROTEC 4 7SA6 (All versions < V4.78), SIPROTEC 4 7SD5 (All versions < V4.78), SIPROTEC 4 7SD610 (All versions < V4.78), SIPROTEC 4 7SJ61 (All versions), SIPROTEC 4 7SJ62 (All versions), SIPROTEC 4 7SJ63 (All versions), SIPROTEC 4 7SJ64 (All versions), SIPROTEC 4 7SJ66 (All versions), SIPROTEC 4 7SS52 (All versions), SIPROTEC 4 7ST6 (All versions), SIPROTEC 4 7UM61 (All versions), SIPROTEC 4 7UM62 (All versions), SIPROTEC 4 7UT612 (All versions), SIPROTEC 4 7UT613 (All versions), SIPROTEC 4 7UT63 (All versions), SIPROTEC 4 7VE6 (All versions), SIPROTEC 4 7VK61 (All versions), SIPROTEC 4 7VU683 (All versions), SIPROTEC 4 Compact 7RW80 (All versions), SIPROTEC 4 Compact 7SD80 (All versions), SIPROTEC 4 Compact 7SJ80 (All versions), SIPROTEC 4 Compact 7SJ81 (All versions), SIPROTEC 4 Compact 7SK80 (All versions), SIPROTEC 4 Compact 7SK81 (All versions). Affected devices do not properly handle interrupted operations of file transfer. This could allow an unauthenticated remote attacker to cause a denial of service condition. To restore normal operations, the devices need to be restarted.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 12:15:00 GMT

CVE-2024-54678 - Siemens SIMATIC and TIA Portal Named Pipe Remote Code Execution Vulnerability

CVE ID : CVE-2024-54678
Published : Aug. 12, 2025, 12:15 p.m. | 3 hours, 13 minutes ago
Description : A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SIMATIC PCS neo V6.0 (All versions), SIMATIC S7-PLCSIM V17 (All versions), SIMATIC STEP 7 V17 (All versions), SIMATIC STEP 7 V18 (All versions), SIMATIC STEP 7 V19 (All versions < V19 Update 4), SIMATIC STEP 7 V20 (All versions), SIMATIC WinCC V17 (All versions), SIMATIC WinCC V18 (All versions), SIMATIC WinCC V19 (All versions < V19 Update 4), SIMATIC WinCC V20 (All versions), SIMOCODE ES V17 (All versions), SIMOCODE ES V18 (All versions), SIMOCODE ES V19 (All versions), SIMOCODE ES V20 (All versions), SIMOTION SCOUT TIA V5.4 (All versions), SIMOTION SCOUT TIA V5.5 (All versions), SIMOTION SCOUT TIA V5.6 (All versions < V5.6 SP1 HF7), SIMOTION SCOUT TIA V5.7 (All versions), SINAMICS Startdrive V17 (All versions), SINAMICS Startdrive V18 (All versions), SINAMICS Startdrive V19 (All versions), SINAMICS Startdrive V20 (All versions), SIRIUS Safety ES V17 (TIA Portal) (All versions), SIRIUS Safety ES V18 (TIA Portal) (All versions), SIRIUS Safety ES V19 (TIA Portal) (All versions), SIRIUS Safety ES V20 (TIA Portal) (All versions), SIRIUS Soft Starter ES V17 (TIA Portal) (All versions), SIRIUS Soft Starter ES V18 (TIA Portal) (All versions), SIRIUS Soft Starter ES V19 (TIA Portal) (All versions), SIRIUS Soft Starter ES V20 (TIA Portal) (All versions), TIA Portal Cloud V17 (All versions), TIA Portal Cloud V18 (All versions), TIA Portal Cloud V19 (All versions < V5.2.1.1), TIA Portal Cloud V20 (All versions), TIA Portal Test Suite V20 (All versions). Affected products do not properly sanitize Interprocess Communication input received through a Windows Named Pipe accessible to all local users. This could allow an authenticated local attacker to cause a type confusion and execute arbitrary code within the affected application.
Severity: 8.2 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 12:15:00 GMT

CVE-2025-30033 - Apache Setup DLL Hijacking Vulnerability

CVE ID : CVE-2025-30033
Published : Aug. 12, 2025, 12:15 p.m. | 3 hours, 13 minutes ago
Description : The affected setup component is vulnerable to DLL hijacking. This could allow an attacker to execute arbitrary code when a legitimate user installs an application that uses the affected setup component.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 12:15:00 GMT

CVE-2025-30034 - "SIMATIC RTLS Locating Manager Unauthenticated Local Denial of Service"

CVE ID : CVE-2025-30034
Published : Aug. 12, 2025, 12:15 p.m. | 3 hours, 13 minutes ago
Description : A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V3.3). Affected devices do not properly validate input sent to its listening port on the local loopback interface. This could allow an unauthenticated local attacker to cause a denial of service condition.
Severity: 6.2 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 12:15:00 GMT

CVE-2025-33023 - RUGGEDCOM ROX File Upload Privilege Escalation Vulnerability

CVE ID : CVE-2025-33023
Published : Aug. 12, 2025, 12:15 p.m. | 3 hours, 13 minutes ago
Description : A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions), RUGGEDCOM ROX MX5000RE (All versions), RUGGEDCOM ROX RX1400 (All versions), RUGGEDCOM ROX RX1500 (All versions), RUGGEDCOM ROX RX1501 (All versions), RUGGEDCOM ROX RX1510 (All versions), RUGGEDCOM ROX RX1511 (All versions), RUGGEDCOM ROX RX1512 (All versions), RUGGEDCOM ROX RX1524 (All versions), RUGGEDCOM ROX RX1536 (All versions), RUGGEDCOM ROX RX5000 (All versions). The affected devices do not properly enforce the restriction of files that can be uploaded from the web interface. This could allow an authenticated remote attacker with high privileges in the web interface to upload arbitrary files.
Severity: 4.1 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 12:15:00 GMT

CVE-2025-40570 - Siemens SIPROTEC 5 USB Port Bandwidth Exhaustion Vulnerability

CVE ID : CVE-2025-40570
Published : Aug. 12, 2025, 12:15 p.m. | 3 hours, 13 minutes ago
Description : A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions < V10.0), SIPROTEC 5 6MD85 (CP300) (All versions >= V7.80 < V10.0), SIPROTEC 5 6MD86 (CP300) (All versions >= V7.80 < V10.0), SIPROTEC 5 6MD89 (CP300) (All versions >= V7.80 < V10.0), SIPROTEC 5 6MU85 (CP300) (All versions >= V7.80 < V10.0), SIPROTEC 5 7KE85 (CP300) (All versions >= V7.80 < V10.0), SIPROTEC 5 7SA82 (CP150) (All versions < V10.0), SIPROTEC 5 7SA86 (CP300) (All versions >= V7.80 < V10.0), SIPROTEC 5 7SA87 (CP300) (All versions >= V7.80 < V10.0), SIPROTEC 5 7SD82 (CP150) (All versions < V10.0), SIPROTEC 5 7SD86 (CP300) (All versions >= V7.80 < V10.0), SIPROTEC 5 7SD87 (CP300) (All versions >= V7.80 < V10.0), SIPROTEC 5 7SJ81 (CP150) (All versions < V10.0), SIPROTEC 5 7SJ82 (CP150) (All versions < V10.0), SIPROTEC 5 7SJ85 (CP300) (All versions >= V7.80 < V10.0), SIPROTEC 5 7SJ86 (CP300) (All versions >= V7.80 < V10.0), SIPROTEC 5 7SK82 (CP150) (All versions < V10.0), SIPROTEC 5 7SK85 (CP300) (All versions >= V7.80 < V10.0), SIPROTEC 5 7SL82 (CP150) (All versions < V10.0), SIPROTEC 5 7SL86 (CP300) (All versions >= V7.80 < V10.0), SIPROTEC 5 7SL87 (CP300) (All versions >= V7.80 < V10.0), SIPROTEC 5 7SS85 (CP300) (All versions >= V7.80 < V10.0), SIPROTEC 5 7ST85 (CP300) (All versions < V10.0), SIPROTEC 5 7ST86 (CP300) (All versions < V10.0), SIPROTEC 5 7SX82 (CP150) (All versions < V10.0), SIPROTEC 5 7SX85 (CP300) (All versions < V10.0), SIPROTEC 5 7SY82 (CP150) (All versions < V10.0), SIPROTEC 5 7UM85 (CP300) (All versions >= V7.80 < V10.0), SIPROTEC 5 7UT82 (CP150) (All versions < V10.0), SIPROTEC 5 7UT85 (CP300) (All versions >= V7.80 < V10.0), SIPROTEC 5 7UT86 (CP300) (All versions >= V7.80 < V10.0), SIPROTEC 5 7UT87 (CP300) (All versions >= V7.80 < V10.0), SIPROTEC 5 7VE85 (CP300) (All versions >= V7.80 < V10.0), SIPROTEC 5 7VK87 (CP300) (All versions >= V7.80 < V10.0), SIPROTEC 5 7VU85 (CP300) (All versions < V10.0), SIPROTEC 5 Compact 7SX800 (CP050) (All versions < V10.0). Affected devices do not properly limit the bandwidth for incoming network packets over their local USB port. This could allow an attacker with physical access to send specially crafted packets with high bandwidth to the affected devices thus forcing them to exhaust their memory and stop responding to any network traffic via the local USB port. Affected devices reset themselves automatically after a successful attack. The protection function is not affected of this vulnerability.
Severity: 2.4 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 12:15:00 GMT

CVE-2025-40584 - Siemens SIMOTION and SINAMICS XXE File Disclosure Vulnerability

CVE ID : CVE-2025-40584
Published : Aug. 12, 2025, 12:15 p.m. | 3 hours, 13 minutes ago
Description : A vulnerability has been identified in SIMOTION SCOUT TIA V5.4 (All versions), SIMOTION SCOUT TIA V5.5 (All versions), SIMOTION SCOUT TIA V5.6 (All versions < V5.6 SP1 HF7), SIMOTION SCOUT TIA V5.7 (All versions < V5.7 SP1 HF1), SIMOTION SCOUT V5.4 (All versions), SIMOTION SCOUT V5.5 (All versions), SIMOTION SCOUT V5.6 (All versions < V5.6 SP1 HF7), SIMOTION SCOUT V5.7 (All versions < V5.7 SP1 HF1), SINAMICS STARTER V5.5 (All versions), SINAMICS STARTER V5.6 (All versions), SINAMICS STARTER V5.7 (All versions). The affected application contains a XML External Entity Injection (XXE) vulnerability while parsing specially crafted XML files. This could allow an attacker to read arbitrary files in the system.
Severity: 5.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 12:15:00 GMT

CVE-2025-40743 - Siemens SINUMERIK VNC Authentication Bypass

CVE ID : CVE-2025-40743
Published : Aug. 12, 2025, 12:15 p.m. | 3 hours, 13 minutes ago
Description : A vulnerability has been identified in SINUMERIK 828D PPU.4 (All versions < V4.95 SP5), SINUMERIK 828D PPU.5 (All versions < V5.25 SP1), SINUMERIK 840D sl (All versions < V4.95 SP5), SINUMERIK MC (All versions < V1.25 SP1), SINUMERIK MC V1.15 (All versions < V1.15 SP5), SINUMERIK ONE (All versions < V6.25 SP1), SINUMERIK ONE V6.15 (All versions < V6.15 SP5). The affected application improperly validates authentication for its VNC access service, allowing access with insufficient password verification. This could allow an attacker to gain unauthorized remote access and potentially compromise system confidentiality, integrity, or availability.
Severity: 8.3 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 12:15:00 GMT

CVE-2025-40746 - "Siemens SIMATIC RTLS Locating Manager Remote Code Execution Vulnerability"

CVE ID : CVE-2025-40746
Published : Aug. 12, 2025, 12:15 p.m. | 3 hours, 13 minutes ago
Description : A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V3.2). Affected products do not properly validate input for a backup script. This could allow an authenticated remote attacker with high privileges in the application to execute arbitrary code with 'NT Authority/SYSTEM' privileges.
Severity: 9.1 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 12:15:00 GMT

CVE-2025-40751 - SIMATIC RTLS Locating Manager Credential Exposure (Authentication Bypass)

CVE ID : CVE-2025-40751
Published : Aug. 12, 2025, 12:15 p.m. | 3 hours, 13 minutes ago
Description : A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V3.3). Affected SIMATIC RTLS Locating Manager Report Clients do not properly protect credentials that are used to authenticate to the server. This could allow an authenticated local attacker to extract the credentials and use them to escalate their access rights from the Manager to the Systemadministrator role.
Severity: 6.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 12:15:00 GMT

CVE-2025-40752 - SICAM Power Meter Password Storage Vulnerability

CVE ID : CVE-2025-40752
Published : Aug. 12, 2025, 12:15 p.m. | 3 hours, 13 minutes ago
Description : A vulnerability has been identified in POWER METER SICAM Q100 (7KG9501-0AA01-0AA1) (All versions >= V2.60 < V2.62), POWER METER SICAM Q100 (7KG9501-0AA01-2AA1) (All versions >= V2.60 < V2.62), POWER METER SICAM Q100 (7KG9501-0AA31-0AA1) (All versions >= V2.60 < V2.62), POWER METER SICAM Q100 (7KG9501-0AA31-2AA1) (All versions >= V2.60 < V2.62), POWER METER SICAM Q200 family (All versions >= V2.70 < V2.80). Affected devices store the password for the SMTP account as plain text. This could allow an authenticated local attacker to extract it and use the configured SMTP service for arbitrary purposes.
Severity: 6.2 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 12:15:00 GMT

CVE-2025-40753 - SICAM Power Meter SMTP Password Exposure

CVE ID : CVE-2025-40753
Published : Aug. 12, 2025, 12:15 p.m. | 3 hours, 13 minutes ago
Description : A vulnerability has been identified in POWER METER SICAM Q100 (7KG9501-0AA01-0AA1) (All versions >= V2.60 < V2.62), POWER METER SICAM Q100 (7KG9501-0AA01-2AA1) (All versions >= V2.60 < V2.62), POWER METER SICAM Q100 (7KG9501-0AA31-0AA1) (All versions >= V2.60 < V2.62), POWER METER SICAM Q100 (7KG9501-0AA31-2AA1) (All versions >= V2.60 < V2.62), POWER METER SICAM Q200 family (All versions >= V2.70 < V2.80). Affected devices export the password for the SMTP account as plain text in the Configuration File. This could allow an authenticated local attacker to extract it and use the configured SMTP service for arbitrary purposes.
Severity: 6.2 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 12:15:00 GMT

CVE-2025-40759 - Siemens TIA Portal and SIMATIC Products Remote Code Execution Vulnerability

CVE ID : CVE-2025-40759
Published : Aug. 12, 2025, 12:15 p.m. | 3 hours, 13 minutes ago
Description : A vulnerability has been identified in SIMATIC S7-PLCSIM V17 (All versions), SIMATIC STEP 7 V17 (All versions), SIMATIC STEP 7 V18 (All versions), SIMATIC STEP 7 V19 (All versions < V19 Update 4), SIMATIC STEP 7 V20 (All versions), SIMATIC WinCC V17 (All versions), SIMATIC WinCC V18 (All versions), SIMATIC WinCC V19 (All versions < V19 Update 4), SIMATIC WinCC V20 (All versions), SIMOCODE ES V17 (All versions), SIMOCODE ES V18 (All versions), SIMOCODE ES V19 (All versions), SIMOCODE ES V20 (All versions), SIMOTION SCOUT TIA V5.4 (All versions), SIMOTION SCOUT TIA V5.5 (All versions), SIMOTION SCOUT TIA V5.6 (All versions < V5.6 SP1 HF7), SIMOTION SCOUT TIA V5.7 (All versions), SINAMICS Startdrive V17 (All versions), SINAMICS Startdrive V18 (All versions), SINAMICS Startdrive V19 (All versions), SINAMICS Startdrive V20 (All versions), SIRIUS Safety ES V17 (TIA Portal) (All versions), SIRIUS Safety ES V18 (TIA Portal) (All versions), SIRIUS Safety ES V19 (TIA Portal) (All versions), SIRIUS Safety ES V20 (TIA Portal) (All versions), SIRIUS Soft Starter ES V17 (TIA Portal) (All versions), SIRIUS Soft Starter ES V18 (TIA Portal) (All versions), SIRIUS Soft Starter ES V19 (TIA Portal) (All versions), SIRIUS Soft Starter ES V20 (TIA Portal) (All versions), TIA Portal Cloud V17 (All versions), TIA Portal Cloud V18 (All versions), TIA Portal Cloud V19 (All versions < V5.2.1.1), TIA Portal Cloud V20 (All versions). Affected products do not properly sanitize stored security properties when parsing project files. This could allow an attacker to cause a type confusion and execute arbitrary code within the affected application.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 12:15:00 GMT

CVE-2025-40761 - RUGGEDCOM ROX Devices Physical Access Bypass Authentication Vulnerability

CVE ID : CVE-2025-40761
Published : Aug. 12, 2025, 12:15 p.m. | 3 hours, 13 minutes ago
Description : A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions), RUGGEDCOM ROX MX5000RE (All versions), RUGGEDCOM ROX RX1400 (All versions), RUGGEDCOM ROX RX1500 (All versions), RUGGEDCOM ROX RX1501 (All versions), RUGGEDCOM ROX RX1510 (All versions), RUGGEDCOM ROX RX1511 (All versions), RUGGEDCOM ROX RX1512 (All versions), RUGGEDCOM ROX RX1524 (All versions), RUGGEDCOM ROX RX1536 (All versions), RUGGEDCOM ROX RX5000 (All versions). Affected devices do not properly limit access through its Built-In-Self-Test (BIST) mode. This could allow an attacker with physical access to the serial interface to bypass authentication and get access to a root shell on the device.
Severity: 7.6 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 12:15:00 GMT

CVE-2025-40762 - "Simcenter Femap STP File Out-of-Bounds Write Vulnerability"

CVE ID : CVE-2025-40762
Published : Aug. 12, 2025, 12:15 p.m. | 3 hours, 13 minutes ago
Description : A vulnerability has been identified in Simcenter Femap V2406 (All versions < V2406.0003), Simcenter Femap V2412 (All versions < V2412.0002). The affected applications contain an out of bounds write vulnerability when parsing a specially crafted STP file. This could allow an attacker to execute code in the context of the current process.(ZDI-CAN-26692)
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 12:15:00 GMT

CVE-2025-40764 - Simcenter Femap BMP File Out-of-Bounds Read Vulnerability

CVE ID : CVE-2025-40764
Published : Aug. 12, 2025, 12:15 p.m. | 3 hours, 13 minutes ago
Description : A vulnerability has been identified in Simcenter Femap V2406 (All versions < V2406.0003), Simcenter Femap V2412 (All versions < V2412.0002). The affected applications contains an out of bounds read vulnerability while parsing specially crafted BMP files. This could allow an attacker to execute code in the context of the current process.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 12:15:00 GMT

CVE-2024-41984 - Siemens Opcenter QL Home, SOA Audit, and SOA Cockpit Improper Error Handling Exposes System Applications

CVE ID : CVE-2024-41984
Published : Aug. 12, 2025, 12:15 p.m. | 1 hour, 48 minutes ago
Description : A vulnerability has been identified in SmartClient modules Opcenter QL Home (SC) (All versions >= V13.2 < V2506), SOA Audit (All versions >= V13.2 < V2506), SOA Cockpit (All versions >= V13.2 < V2506). The affected application improperly handles error while accessing an inaccessible resource leading to exposing the system applications.
Severity: 2.6 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 12:15:00 GMT

CVE-2024-41985 - Siemens Opcenter QL Home and SOA Session Persistence Vulnerability

CVE ID : CVE-2024-41985
Published : Aug. 12, 2025, 12:15 p.m. | 1 hour, 48 minutes ago
Description : A vulnerability has been identified in SmartClient modules Opcenter QL Home (SC) (All versions >= V13.2 < V2506), SOA Audit (All versions >= V13.2 < V2506), SOA Cockpit (All versions >= V13.2 < V2506). The affected application does not expire the session without logout. This could allow an attacker to get unauthorized access if the session is left idle.
Severity: 2.6 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 12:15:00 GMT

CVE-2024-41983 - Siemens Opcenter QL Home, SOA Audit, and SOA Cockpit SQL Injection Vulnerability

CVE ID : CVE-2024-41983
Published : Aug. 12, 2025, 12:15 p.m. | 22 minutes ago
Description : A vulnerability has been identified in SmartClient modules Opcenter QL Home (SC) (All versions >= V13.2 < V2506), SOA Audit (All versions >= V13.2 < V2506), SOA Cockpit (All versions >= V13.2 < V2506). The affected application displays SQL statement in the error messages encountered during the generation of reports using Cockpit tool.
Severity: 3.5 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 12:15:00 GMT

CVE-2025-43736 - Liferay Portal Liferay DXP File Upload Denial Of Service (DOS)

CVE ID : CVE-2025-43736
Published : Aug. 12, 2025, 11:15 a.m. | 53 minutes ago
Description : A Denial Of Service via File Upload (DOS) vulnerability in the Liferay Portal 7.4.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allows a user to upload more than 300kb profile picture into the user profile. This size more than the noted max 300kb size. This extra amount of data can make Liferay slower.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 11:15:00 GMT

CVE-2025-8885 - Bouncy Castle for Java Resource Allocation Denial of Service

CVE ID : CVE-2025-8885
Published : Aug. 12, 2025, 10:15 a.m. | 1 hour, 53 minutes ago
Description : Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java on All (API modules) allows Excessive Allocation. This vulnerability is associated with program files https://github.Com/bcgit/bc-java/blob/main/core/src/main/java/org/bouncycastle/asn1/ASN1ObjectIdentifier.Java. This issue affects Bouncy Castle for Java: from BC 1.0 through 1.77, from BC-FJA 1.0.0 through 2.0.0.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 10:15:00 GMT

CVE-2025-26398 - SolarWinds Database Performance Analyzer Cryptographic Key Disclosure

CVE ID : CVE-2025-26398
Published : Aug. 12, 2025, 8:15 a.m. | 3 hours, 53 minutes ago
Description : SolarWinds Database Performance Analyzer was found to contain a hard-coded cryptographic key. If exploited, this vulnerability could lead to a machine-in-the-middle (MITM) attack against users. This vulnerability requires additional software not installed by default, local access to the server and administrator level privileges on the host.
Severity: 5.6 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 08:15:00 GMT

CVE-2025-41686 - Microsoft NSSM Elevation of Privilege

CVE ID : CVE-2025-41686
Published : Aug. 12, 2025, 8:15 a.m. | 3 hours, 53 minutes ago
Description : A low-privileged local attacker can exploit improper permissions on nssm.exe to escalate their privileges and gain administrative access.
Severity: 7.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 08:15:00 GMT

CVE-2025-47444 - Liquid Web GiveWP Sensitive Data Retrieval Vulnerability

CVE ID : CVE-2025-47444
Published : Aug. 12, 2025, 7:15 a.m. | 4 hours, 53 minutes ago
Description : Insertion of Sensitive Information Into Sent Data vulnerability in Liquid Web GiveWP allows Retrieve Embedded Sensitive Data.This issue affects GiveWP: from n/a before 4.6.1.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 07:15:00 GMT

CVE-2025-8418 - WordPress B Slider-Gutenberg Slider Block Plugin Arbitrary Plugin Installation Vulnerability

CVE ID : CVE-2025-8418
Published : Aug. 12, 2025, 7:15 a.m. | 4 hours, 53 minutes ago
Description : The B Slider- Gutenberg Slider Block for WP plugin for WordPress is vulnerable to Arbitrary Plugin Installation in all versions up to, and including, 1.1.30. This is due to missing capability checks on the activated_plugin function. This makes it possible for authenticated attackers, with subscriber-level access and above, to install arbitrary plugins on the server which can make remote code execution possible.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 07:15:00 GMT

CVE-2025-8482 - WordPress Simple Local Avatars Unauthenticated Data Modification Vulnerability

CVE ID : CVE-2025-8482
Published : Aug. 12, 2025, 7:15 a.m. | 4 hours, 53 minutes ago
Description : The Simple Local Avatars plugin for WordPress is vulnerable to unauthorized modification of data in version 2.8.4. This is due to a missing capability check on the migrate_from_wp_user_avatar() function. This makes it possible for authenticated attackers, with subscriber-level access and above, to migrate avatar metadata for all users.
Severity: 4.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 07:15:00 GMT

CVE-2025-8767 - WordPress AnWP Football Leagues Plugin CSV Injection Vulnerability

CVE ID : CVE-2025-8767
Published : Aug. 12, 2025, 7:15 a.m. | 4 hours, 53 minutes ago
Description : The AnWP Football Leagues plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 0.16.17 via the 'download_csv_players' and 'download_csv_games' functions. This makes it possible for authenticated attackers, with Administrator-level access and above, to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.
Severity: 4.8 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 07:15:00 GMT

CVE-2025-8874 - Elementor Addons - WordPress Stored Cross-Site Scripting Vulnerability

CVE ID : CVE-2025-8874
Published : Aug. 12, 2025, 7:15 a.m. | 4 hours, 53 minutes ago
Description : The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 2.0.8.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity: 6.4 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 07:15:00 GMT

CVE-2025-30027 - Axis ACAP Code Execution Vulnerability

CVE ID : CVE-2025-30027
Published : Aug. 12, 2025, 6:15 a.m. | 5 hours, 53 minutes ago
Description : An ACAP configuration file lacked sufficient input validation, which could allow for arbitrary code execution. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.
Severity: 6.7 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 06:15:00 GMT

CVE-2025-3892 - Axis ACAP Privilege Escalation Vulnerability

CVE ID : CVE-2025-3892
Published : Aug. 12, 2025, 6:15 a.m. | 5 hours, 53 minutes ago
Description : ACAP applications can be executed with elevated privileges, potentially leading to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application.
Severity: 6.7 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 06:15:00 GMT

CVE-2025-6253 - "UiCore Elements WordPress Arbitrary File Read Vulnerability"

CVE ID : CVE-2025-6253
Published : Aug. 12, 2025, 6:15 a.m. | 5 hours, 53 minutes ago
Description : The UiCore Elements – Free Elementor widgets and templates plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.3.0 via the prepare_template() function due to a missing capability check and insufficient controls on the filename specified. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 06:15:00 GMT

CVE-2025-8081 - Elementor WordPress Arbitrary File Read Vulnerability

CVE ID : CVE-2025-8081
Published : Aug. 12, 2025, 6:15 a.m. | 5 hours, 53 minutes ago
Description : The Elementor plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.30.2 via the Import_Images::import() function due to insufficient controls on the filename specified. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
Severity: 4.9 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 06:15:00 GMT

CVE-2025-7622 - Apache Server-Side Request Forgery

CVE ID : CVE-2025-7622
Published : Aug. 12, 2025, 5:15 a.m. | 6 hours, 53 minutes ago
Description : During an internal security assessment, a Server-Side Request Forgery (SSRF) vulnerability that allowed an authenticated attacker to access internal resources on the server was discovered.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 05:15:00 GMT

CVE-2025-8059 - WordPress B Blocks Privilege Escalation

CVE ID : CVE-2025-8059
Published : Aug. 12, 2025, 5:15 a.m. | 6 hours, 53 minutes ago
Description : The B Blocks plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization and improper input validation within the rgfr_registration() function in all versions up to, and including, 2.0.6. This makes it possible for unauthenticated attackers to create a new account and assign it the administrator role.
Severity: 9.8 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 05:15:00 GMT

CVE-2025-8314 - WordPress Software Issue Manager Stored Cross-Site Scripting Vulnerability

CVE ID : CVE-2025-8314
Published : Aug. 12, 2025, 5:15 a.m. | 6 hours, 53 minutes ago
Description : The Software Issue Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘noaccess_msg parameter in all versions up to, and including, 5.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity: 6.4 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 05:15:00 GMT

CVE-2025-42976 - SAP NetWeaver Application Server ABAP Buffer Overflow

CVE ID : CVE-2025-42976
Published : Aug. 12, 2025, 3:15 a.m. | 8 hours, 53 minutes ago
Description : SAP NetWeaver Application Server ABAP (BIC Document) allows an authenticated attacker to craft a request that, when submitted to a BIC Document application, could cause a memory corruption error. On successful exploitation, this results in the crash of the target component. Multiple submissions can make the target completely unavailable. A similarly crafted submission can be used to perform an out-of-bounds read operation as well, revealing sensitive information that is loaded in memory at that time. There is no ability to modify any information.
Severity: 8.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 03:15:00 GMT

CVE-2025-4390 - WordPress Private Content Plus Sensitive Information Exposure

CVE ID : CVE-2025-4390
Published : Aug. 12, 2025, 3:15 a.m. | 8 hours, 53 minutes ago
Description : The WP Private Content Plus plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.6.2 via the 'validate_restrictions' function. This makes it possible for unauthenticated attackers to extract sensitive data including the content of resticted posts on archive and feed pages.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 03:15:00 GMT

CVE-2025-5391 - WooCommerce Purchase Orders Remote Code Execution via File Deletion Vulnerability

CVE ID : CVE-2025-5391
Published : Aug. 12, 2025, 3:15 a.m. | 8 hours, 53 minutes ago
Description : The WooCommerce Purchase Orders plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_file() function in all versions up to, and including, 1.0.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Severity: 8.1 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 03:15:00 GMT

CVE-2025-8462 - Elementor RT Easy Builder Stored Cross-Site Scripting Vulnerability

CVE ID : CVE-2025-8462
Published : Aug. 12, 2025, 3:15 a.m. | 8 hours, 53 minutes ago
Description : The RT Easy Builder – Advanced addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the social URL parameter in all versions up to, and including, 2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity: 6.4 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 03:15:00 GMT

CVE-2025-8568 - WordPress GMap Generator Stored Cross-Site Scripting Vulnerability

CVE ID : CVE-2025-8568
Published : Aug. 12, 2025, 3:15 a.m. | 8 hours, 53 minutes ago
Description : The GMap Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘h’ parameter in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity: 6.4 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 03:15:00 GMT

CVE-2025-8621 - Mosaic Generator Stored Cross-Site Scripting Vulnerability in WordPress

CVE ID : CVE-2025-8621
Published : Aug. 12, 2025, 3:15 a.m. | 8 hours, 53 minutes ago
Description : The Mosaic Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘c’ parameter in all versions up to, and including, 1.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity: 6.4 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 03:15:00 GMT

CVE-2025-8685 - WordPress Wp Chart Generator Stored Cross-Site Scripting Vulnerability

CVE ID : CVE-2025-8685
Published : Aug. 12, 2025, 3:15 a.m. | 8 hours, 53 minutes ago
Description : The Wp chart generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpchart shortcode in all versions up to, and including, 1.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity: 6.4 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 03:15:00 GMT

CVE-2025-8688 - WordPress Inline Stock Quotes Stored Cross-Site Scripting Vulnerability

CVE ID : CVE-2025-8688
Published : Aug. 12, 2025, 3:15 a.m. | 8 hours, 53 minutes ago
Description : The Inline Stock Quotes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's stock shortcode in all versions up to, and including, 0.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity: 6.4 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 03:15:00 GMT

CVE-2025-8690 - WordPress Simple Responsive Slider Stored Cross-Site Scripting Vulnerability

CVE ID : CVE-2025-8690
Published : Aug. 12, 2025, 3:15 a.m. | 8 hours, 53 minutes ago
Description : The Simple Responsive Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity: 6.4 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 03:15:00 GMT

CVE-2025-42957 - SAP S/4HANA ABAP Code Injection Backdoor Vulnerability

CVE ID : CVE-2025-42957
Published : Aug. 12, 2025, 3:15 a.m. | 6 hours, 57 minutes ago
Description : SAP S/4HANA allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary ABAP code into the system, bypassing essential authorization checks. This vulnerability effectively functions as a backdoor, creating the risk of full system compromise, undermining the confidentiality, integrity and availability of the system.
Severity: 9.9 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 03:15:00 GMT

CVE-2025-42975 - SAP NetWeaver Application Server ABAP Cross-Site Scripting (XSS)

CVE ID : CVE-2025-42975
Published : Aug. 12, 2025, 3:15 a.m. | 6 hours, 57 minutes ago
Description : SAP NetWeaver Application Server ABAP (BIC Document) allows an unauthenticated attacker to craft a URL link which, when accessed on the BIC Document application, embeds a malicious script. When a victim clicks on this link, the script executes in the victim's browser, allowing the attacker to access and/or modify information related to the web client without affecting availability.
Severity: 6.1 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 03:15:00 GMT

CVE-2025-42951 - SAP Business One (SLD) Privilege Escalation Vulnerability

CVE ID : CVE-2025-42951
Published : Aug. 12, 2025, 3:15 a.m. | 4 hours, 53 minutes ago
Description : Due to broken authorization, SAP Business One (SLD) allows an authenticated attacker to gain administrator privileges of a database by invoking the corresponding API.�As a result , it has a high impact on the confidentiality, integrity, and availability of the application.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 03:15:00 GMT

CVE-2025-42955 - SAP Cloud Connector LDAP Connection Testing Information Disclosure

CVE ID : CVE-2025-42955
Published : Aug. 12, 2025, 3:15 a.m. | 4 hours, 53 minutes ago
Description : Due to a missing authorization check in SAP Cloud Connector, an attacker on an adjacent network with low privileges could send a crafted request to the endpoint responsible for testing LDAP connections. A successful exploit could lead to reduced performance, hence a low-impact on availability of the service. Confidentiality and integrity of the data are not affected.
Severity: 3.5 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 03:15:00 GMT

CVE-2025-42936 - SAP NetWeaver Application Server for ABAP Privilege Escalation Vulnerability

CVE ID : CVE-2025-42936
Published : Aug. 12, 2025, 3:15 a.m. | 3 hours, 44 minutes ago
Description : The SAP NetWeaver Application Server for ABAP does not enable an administrator to assign distinguished authorizations for different user roles, this issue allows authenticated users to access restricted objects in the barcode interface, leading to privilege escalation. This results in a low impact on the confidentiality and integrity of the application, there is no impact on availability.
Severity: 5.4 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 03:15:00 GMT

CVE-2025-42941 - SAP Fiori Launchpad Reverse Tabnabbing Vulnerability

CVE ID : CVE-2025-42941
Published : Aug. 12, 2025, 3:15 a.m. | 3 hours, 44 minutes ago
Description : SAP Fiori (Launchpad) is vulnerable to Reverse Tabnabbing vulnerability due to inadequate external navigation protections for its link () elements. An attacker with administrative user privileges could exploit this by leveraging compromised or malicious pages. While administrative access is necessary for certain configurations, the attacker does not need the administrative privileges to execute the attack. This could result in unintended manipulation of user sessions or exposure of sensitive information. The issue impacts the confidentiality and integrity of the system, but the availability remains unaffected.
Severity: 3.5 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE-2025-42942 - SAP NetWeaver Application Server for ABAP Cross-Site Scripting (XSS)

CVE ID : CVE-2025-42942
Published : Aug. 12, 2025, 3:15 a.m. | 3 hours, 44 minutes ago
Description : SAP NetWeaver Application Server for ABAP has cross-site scripting vulnerability. Due to this, an unauthenticated attacker could craft a URL embedded with malicious script and trick an unauthenticated victim to click on it to execute the script. Upon successful exploitation, the attacker could access and modify limited information within the scope of victim's browser. This vulnerability has no impact on availability of the application.
Severity: 6.1 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 03:15:00 GMT

CVE-2025-42943 - SAP GUI for Windows NTLM Hash Leak

CVE ID : CVE-2025-42943
Published : Aug. 12, 2025, 3:15 a.m. | 3 hours, 44 minutes ago
Description : SAP GUI for Windows may allow the leak of NTML hashes when specific ABAP frontend services are called with UNC paths. For a successful attack, the attacker needs developer authorization in a specific Application Server ABAP to make changes in the code, and the victim needs to execute by using SAP GUI for Windows. This could trigger automatic NTLM authentication, potentially exposing hashed credentials to an attacker. As a result, it has a high impact on the confidentiality.
Severity: 4.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 03:15:00 GMT

CVE-2025-42945 - SAP NetWeaver Application Server ABAP HTML Injection Vulnerability

CVE ID : CVE-2025-42945
Published : Aug. 12, 2025, 3:15 a.m. | 3 hours, 44 minutes ago
Description : SAP NetWeaver Application Server ABAP has HTML injection vulnerability. Due to this, an attacker could craft a URL with malicious script as payload and trick a victim with active user session into executing it. Upon successful exploit, this vulnerability could lead to limited access to data or its manipulation. There is no impact on availability.
Severity: 6.1 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 03:15:00 GMT

CVE-2025-42946 - SAP S/4HANA (Bank Communication Management) Directory Traversal Vulnerability

CVE ID : CVE-2025-42946
Published : Aug. 12, 2025, 3:15 a.m. | 3 hours, 44 minutes ago
Description : Due to directory traversal vulnerability in SAP S/4HANA (Bank Communication Management), an attacker with high privileges and access to a specific transaction and method in Bank Communication Management could gain unauthorized access to sensitive operating system files. This could allow the attacker to potentially read or delete these files hence causing a high impact on confidentiality and low impact on integrity. There is no impact on availability of the system.
Severity: 6.9 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 03:15:00 GMT

CVE-2025-42948 - SAP NetWeaver ABAP Platform Cross-Site Scripting Vulnerability

CVE ID : CVE-2025-42948
Published : Aug. 12, 2025, 3:15 a.m. | 3 hours, 44 minutes ago
Description : Due to a Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver ABAP Platform, an unauthenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated user clicks on this link, the injected input is processed during the website�s page generation, resulting in the creation of malicious content. When this malicious content gets executed, the attacker could gain the ability to access/modify information within the scope of victim�s browser.
Severity: 6.1 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 03:15:00 GMT

CVE-2025-42949 - Oracle ABAP Platform SQL Injection Vulnerability

CVE ID : CVE-2025-42949
Published : Aug. 12, 2025, 3:15 a.m. | 3 hours, 44 minutes ago
Description : Due to a missing authorization check in the ABAP Platform, an authenticated user with elevated privileges could bypass authorization restrictions for common transactions by leveraging the SQL Console. This could enable an attacker to access and read the contents of database tables without proper authorization, leading to a significant compromise of data confidentiality. However, the integrity and availability of the system remain unaffected.
Severity: 4.9 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 03:15:00 GMT

CVE-2025-42950 - SAP SLT ABAP Code Injection Vulnerability

CVE ID : CVE-2025-42950
Published : Aug. 12, 2025, 3:15 a.m. | 3 hours, 44 minutes ago
Description : SAP Landscape Transformation (SLT) allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary ABAP code into the system, bypassing essential authorization checks. This vulnerability effectively functions as a backdoor, creating the risk of full system compromise, undermining the confidentiality, integrity and availability of the system.
Severity: 9.9 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 03:15:00 GMT

CVE-2025-42934 - SAP S/4HANA CRLF Injection Vulnerability

CVE ID : CVE-2025-42934
Published : Aug. 12, 2025, 3:15 a.m. | 1 hour, 44 minutes ago
Description : SAP S/4HANA Supplier invoice is vulnerable to CRLF Injection. An attacker with user-level privileges can bypass the allowlist and insert untrusted sites into the 'Trusted Sites' configuration by injecting line feed (LF) characters into application inputs. This vulnerability has a low impact on the application's integrity and no impact on confidentiality or availability.
Severity: 4.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 03:15:00 GMT

CVE-2025-42935 - SAP NetWeaver Application Server ABAP and ABAP Platform ICM Information Disclosure Vulnerability

CVE ID : CVE-2025-42935
Published : Aug. 12, 2025, 3:15 a.m. | 1 hour, 44 minutes ago
Description : The SAP NetWeaver Application Server ABAP and ABAP Platform Internet Communication Manager (ICM) permits authorized users with admin privileges and local access to log files to read sensitive information, resulting in information disclosure. This leads to high impact on the confidentiality of the application, with no impact on integrity or availability.
Severity: 4.1 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Tue, 12 Aug 2025 03:15:00 GMT

Fuite de données chez Alltricks

intrusion liste de diffusion

Tue Aug 12 2025 02:00:00 GMT+0200 (heure d’été d’Europe centrale)

CVE-2025-55161 - Stirling-PDF SSRF

CVE ID : CVE-2025-55161
Published : Aug. 11, 2025, 11:15 p.m. | 5 hours, 44 minutes ago
Description : Stirling-PDF is a locally hosted web application that performs various operations on PDF files. Prior to version 1.1.0, when using the /api/v1/convert/markdown/pdf endpoint to convert Markdown to PDF, the backend calls a third-party tool to process it and includes a sanitizer for security sanitization which can be bypassed and result in SSRF. This issue has been patched in version 1.1.0.
Severity: 8.6 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 23:15:00 GMT

CVE-2025-55156 - PyLoad SQL Injection Vulnerability

CVE ID : CVE-2025-55156
Published : Aug. 11, 2025, 11:15 p.m. | 3 hours, 21 minutes ago
Description : pyLoad is the free and open-source Download Manager written in pure Python. Prior to version 0.5.0b3.dev91, the parameter add_links in API /json/add_package is vulnerable to SQL Injection. Attackers can modify or delete data in the database, causing data errors or loss. This issue has been patched in version 0.5.0b3.dev91.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 23:15:00 GMT

CVE-2025-55157 - Vim Use-After-Free Vulnerability

CVE ID : CVE-2025-55157
Published : Aug. 11, 2025, 11:15 p.m. | 3 hours, 21 minutes ago
Description : Vim is an open source, command line text editor. In versions from 9.1.1231 to before 9.1.1400, When processing nested tuples in Vim script, an error during evaluation can trigger a use-after-free in Vim’s internal tuple reference management. Specifically, the tuple_unref() function may access already freed memory due to improper lifetime handling, leading to memory corruption. The exploit requires direct user interaction, as the script must be explicitly executed within Vim. This issue has been patched in version 9.1.1400.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 23:15:00 GMT

CVE-2025-55158 - Vim Double-Free Typval Management Vulnerability

CVE ID : CVE-2025-55158
Published : Aug. 11, 2025, 11:15 p.m. | 3 hours, 21 minutes ago
Description : Vim is an open source, command line text editor. In versions from 9.1.1231 to before 9.1.1406, when processing nested tuples during Vim9 script import operations, an error during evaluation can trigger a double-free in Vim’s internal typed value (typval_T) management. Specifically, the clear_tv() function may attempt to free memory that has already been deallocated, due to improper lifetime handling in the handle_import / ex_import code paths. The vulnerability can only be triggered if a user explicitly opens and executes a specially crafted Vim script. This issue has been patched in version 9.1.1406.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 23:15:00 GMT

CVE-2025-55159 - Apache Slab Uninitialized Memory Access Vulnerability

CVE ID : CVE-2025-55159
Published : Aug. 11, 2025, 11:15 p.m. | 3 hours, 21 minutes ago
Description : slab is a pre-allocated storage for a uniform data type. In version 0.4.10, the get_disjoint_mut method incorrectly checked if indices were within the slab's capacity instead of its length, allowing access to uninitialized memory. This could lead to undefined behavior or potential crashes. This has been fixed in slab 0.4.11. A workaround for this issue involves to avoid using get_disjoint_mut with indices that might be beyond the slab's actual length.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 23:15:00 GMT

CVE-2025-25235 - Omnissa Secure Email Gateway (SEG) SSRF

CVE ID : CVE-2025-25235
Published : Aug. 11, 2025, 10:15 p.m. | 4 hours, 21 minutes ago
Description : Server-Side Request Forgery (SSRF) in Omnissa Secure Email Gateway (SEG) in SEG prior to 2.32 running on Windows and SEG prior to 2503 running on UAG allows routing of network traffic such as HTTP requests to internal networks.
Severity: 8.6 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 22:15:00 GMT

CVE-2025-54992 - OpenKilda OpenFlow XXE Injection

CVE ID : CVE-2025-54992
Published : Aug. 11, 2025, 10:15 p.m. | 4 hours, 21 minutes ago
Description : OpenKilda is an open-source OpenFlow controller. Prior to version 1.164.0, an XML external entity (XXE) injection vulnerability was found in OpenKilda which in combination with GHSL-2025-024 allows unauthenticated attackers to exfiltrate information from the instance where the OpenKilda UI is running. This issue may lead to Information disclosure. This issue has been patched in version 1.164.0.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 22:15:00 GMT

CVE-2025-55012 - Zed Agent Panel Remote Code Execution Permissions Bypass

CVE ID : CVE-2025-55012
Published : Aug. 11, 2025, 10:15 p.m. | 4 hours, 21 minutes ago
Description : Zed is a multiplayer code editor. Prior to version 0.197.3, in the Zed Agent Panel allowed for an AI agent to achieve Remote Code Execution (RCE) by bypassing user permission checks. An AI Agent could have exploited a permissions bypass vulnerability to create or modify a project-specific configuration file, leading to the execution of arbitrary commands on a victim's machine without the explicit approval that would otherwise be required. This vulnerability has been patched in version 0.197.3. A workaround for this issue involves either avoid sending prompts to the Agent Panel, or to limit the AI Agent's file system access.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 22:15:00 GMT

CVE-2025-55150 - Stirling-PDF SSRF Vulnerability

CVE ID : CVE-2025-55150
Published : Aug. 11, 2025, 10:15 p.m. | 4 hours, 21 minutes ago
Description : Stirling-PDF is a locally hosted web application that performs various operations on PDF files. Prior to version 1.1.0, when using the /api/v1/convert/html/pdf endpoint to convert HTML to PDF, the backend calls a third-party tool to process it and includes a sanitizer for security sanitization which can be bypassed and result in SSRF. This issue has been patched in version 1.1.0.
Severity: 8.6 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 22:15:00 GMT

CVE-2025-55151 - Stirling-PDF SSRF Vulnerability

CVE ID : CVE-2025-55151
Published : Aug. 11, 2025, 10:15 p.m. | 4 hours, 21 minutes ago
Description : Stirling-PDF is a locally hosted web application that performs various operations on PDF files. Prior to version 1.1.0, the "convert file to pdf" functionality (/api/v1/convert/file/pdf) uses LibreOffice's unoconvert tool for conversion, and SSRF vulnerabilities exist during the conversion process. This issue has been patched in version 1.1.0.
Severity: 8.6 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 22:15:00 GMT

CVE-2024-32640 - MASA CMS SQL Injection Vulnerability

CVE ID : CVE-2024-32640
Published : Aug. 11, 2025, 9:15 p.m. | 5 hours, 21 minutes ago
Description : MASA CMS is an Enterprise Content Management platform based on open source technology. Versions prior to 7.4.6, 7.3.13, and 7.2.8 contain a SQL injection vulnerability in the `processAsyncObject` method that can result in remote code execution. Versions 7.4.6, 7.3.13, and 7.2.8 contain a fix for the issue.
Severity: 9.8 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 21:15:00 GMT

CVE-2025-40920 - Apache::Catalyst::Authentication::Credential::HTTP Weak Nonce Generation

CVE ID : CVE-2025-40920
Published : Aug. 11, 2025, 9:15 p.m. | 5 hours, 21 minutes ago
Description : Catalyst::Authentication::Credential::HTTP versions 1.018 and earlier for Perl generate nonces using the Perl Data::UUID library. * Data::UUID does not use a strong cryptographic source for generating UUIDs. * Data::UUID returns v3 UUIDs, which are generated from known information and are unsuitable for security, as per RFC 9562. * The nonces should be generated from a strong cryptographic source, as per RFC 7616.
Severity: 8.6 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 21:15:00 GMT

CVE-2025-54878 - NASA CryptoLib Heap Buffer Overflow Vulnerability

CVE ID : CVE-2025-54878
Published : Aug. 11, 2025, 9:15 p.m. | 5 hours, 21 minutes ago
Description : CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. A heap buffer overflow vulnerability exists in NASA CryptoLib version 1.4.0 and prior in the IV setup logic for telecommand frames. The problem arises from missing bounds checks when copying the Initialization Vector (IV) into a freshly allocated buffer. An attacker can supply a crafted TC frame that causes the library to write one byte past the end of the heap buffer, leading to heap corruption and undefined behaviour. An attacker supplying a malformed telecommand frame can corrupt heap memory. This leads to undefined behaviour, which could manifest itself as a crash (denial of service) or more severe exploitation. This issue has been patched in version 1.4.0.
Severity: 8.6 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 21:15:00 GMT

CVE-2025-53190 - ABB Aspect Authentication Bypass

CVE ID : CVE-2025-53190
Published : Aug. 11, 2025, 7:15 p.m. | 7 hours, 21 minutes ago
Description : A vulnerability in ABB Aspect.This issue affects Aspect: before <3.08.04-s01.
Severity: 7.0 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 19:15:00 GMT

CVE-2025-53191 - ABB Aspect Missing Authentication for Critical Function Vulnerability

CVE ID : CVE-2025-53191
Published : Aug. 11, 2025, 7:15 p.m. | 7 hours, 21 minutes ago
Description : Missing Authentication for Critical Function vulnerability in ABB Aspect.This issue affects Aspect: before <3.08.04-s01.
Severity: 7.7 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 19:15:00 GMT

CVE-2025-53514 - Mattermost Confluence Plugin Denial of Service (DoS)

CVE ID : CVE-2025-53514
Published : Aug. 11, 2025, 7:15 p.m. | 7 hours, 21 minutes ago
Description : Mattermost Confluence Plugin version <1.5.0 fails to handle unexpected request body which allows attackers to crash the plugin via constant hit to server webhook endpoint with an invalid request body.
Severity: 5.9 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 19:15:00 GMT

CVE-2025-53857 - Mattermost Confluence Plugin Information Disclosure Vulnerability

CVE ID : CVE-2025-53857
Published : Aug. 11, 2025, 7:15 p.m. | 7 hours, 21 minutes ago
Description : Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the channel which allows attackers to get channel subscription details without proper access to the channel via API call to the GET autocomplete/GetChannelSubscriptions endpoint.
Severity: 3.7 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 19:15:00 GMT

CVE-2025-53910 - Mattermost Confluence Plugin Authentication Bypass

CVE ID : CVE-2025-53910
Published : Aug. 11, 2025, 7:15 p.m. | 7 hours, 21 minutes ago
Description : Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the channel which allows attackers to create a channel subscription without proper access to the channel via API call to the edit channel subscription endpoint.
Severity: 4.0 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 19:15:00 GMT

CVE-2025-54458 - Mattermost Confluence Plugin Unauthorized Subscription Creation Vulnerability

CVE ID : CVE-2025-54458
Published : Aug. 11, 2025, 7:15 p.m. | 7 hours, 21 minutes ago
Description : Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the Confluence space which allows attackers to create a subscription for a Confluence space the user does not have access to via the create subscription endpoint.
Severity: 5.0 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 19:15:00 GMT

CVE-2025-54463 - Mattermost Confluence Plugin Denial of Service (DoS)

CVE ID : CVE-2025-54463
Published : Aug. 11, 2025, 7:15 p.m. | 7 hours, 21 minutes ago
Description : Mattermost Confluence Plugin version <1.5.0 fails to handle unexpected request body which allows attackers to crash the plugin via constant hit to server webhook endpoint with an invalid request body.
Severity: 5.9 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 19:15:00 GMT

CVE-2025-54478 - Mattermost Confluence Plugin Authentication Bypass

CVE ID : CVE-2025-54478
Published : Aug. 11, 2025, 7:15 p.m. | 7 hours, 21 minutes ago
Description : Mattermost Confluence Plugin version <1.5.0 fails to enforce authentication of the user to the Mattermost instance which allows unauthenticated attackers to edit channel subscriptions via API call to the edit channel subscription endpoint.
Severity: 7.2 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 19:15:00 GMT

CVE-2025-54525 - Mattermost Confluence Plugin Denial of Service (DoS)

CVE ID : CVE-2025-54525
Published : Aug. 11, 2025, 7:15 p.m. | 7 hours, 21 minutes ago
Description : Mattermost Confluence Plugin version <1.5.0 fails to handle unexpected request body which allows attackers to crash the plugin via constant hit to create channel subscription endpoint with an invalid request body.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 19:15:00 GMT

CVE-2025-7677 - "ABB Aspect Missing Authentication for Critical Function"

CVE ID : CVE-2025-7677
Published : Aug. 11, 2025, 7:15 p.m. | 7 hours, 21 minutes ago
Description : Missing Authentication for Critical Function vulnerability in ABB Aspect.This issue affects Aspect: All versions.
Severity: 5.1 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 19:15:00 GMT

CVE-2025-7679 - ABB Aspect Missing Authentication for Critical Function

CVE ID : CVE-2025-7679
Published : Aug. 11, 2025, 7:15 p.m. | 7 hours, 21 minutes ago
Description : Missing Authentication for Critical Function vulnerability in ABB Aspect.This issue affects Aspect: All versions.
Severity: 7.4 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 19:15:00 GMT

CVE-2025-8285 - Mattermost Confluence Plugin Authentication Bypass

CVE ID : CVE-2025-8285
Published : Aug. 11, 2025, 7:15 p.m. | 7 hours, 21 minutes ago
Description : Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the channel which allows attackers to create channel subscription without proper access to the channel via API call to the create channel subscription endpoint.
Severity: 4.0 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 19:15:00 GMT

CVE-2025-51823 - Libcsp Buffer Overflow Vulnerability

CVE ID : CVE-2025-51823
Published : Aug. 11, 2025, 7:15 p.m. | 3 hours, 21 minutes ago
Description : libcsp 2.0 is vulnerable to Buffer Overflow in the csp_eth_init() function due to improper handling of the ifname parameter. The function uses strcpy to copy the interface name into a structure member (ctx->name) without validating the input length.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 19:15:00 GMT

CVE-2025-51824 - Zephyr libcsp Buffer Overflow

CVE ID : CVE-2025-51824
Published : Aug. 11, 2025, 7:15 p.m. | 3 hours, 21 minutes ago
Description : libcsp 2.0 is vulnerable to Buffer Overflow in the csp_usart_open() function at drivers/usart/zephyr.c.
Severity: 6.5 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 19:15:00 GMT

CVE-2025-52931 - Mattermost Confluence Plugin Denial of Service (DoS)

CVE ID : CVE-2025-52931
Published : Aug. 11, 2025, 7:15 p.m. | 3 hours, 21 minutes ago
Description : Mattermost Confluence Plugin version <1.5.0 fails to handle unexpected request body which allows attackers to crash the plugin via constant hit to update channel subscription endpoint with an invalid request body.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 19:15:00 GMT

CVE-2025-53188 - ABB Aspect Unprotected Credentials

CVE ID : CVE-2025-53188
Published : Aug. 11, 2025, 7:15 p.m. | 3 hours, 21 minutes ago
Description : Insufficiently Protected Credentials vulnerability in ABB Aspect.This issue affects Aspect: before <3.08.04-s01.
Severity: 7.0 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 19:15:00 GMT

CVE-2025-53189 - ABB Aspect Authorization Bypass Through User-Controlled Key Vulnerability

CVE ID : CVE-2025-53189
Published : Aug. 11, 2025, 7:15 p.m. | 3 hours, 21 minutes ago
Description : Authorization Bypass Through User-Controlled Key vulnerability in ABB Aspect.This issue affects Aspect: from o before <3.08.04-s01.
Severity: 7.0 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 19:15:00 GMT

CVE-2025-25229 - VMware Workspace ONE UEM SSRF Vulnerability

CVE ID : CVE-2025-25229
Published : Aug. 11, 2025, 7:15 p.m. | 2 hours, 30 minutes ago
Description : Omnissa Workspace ONE UEM contains a Server-Side Request Forgery (SSRF) Vulnerability. A malicious actor with user privileges may be able to access restricted internal system information, potentially enabling enumeration of internal network resources.
Severity: 5.4 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 19:15:00 GMT

CVE-2025-44001 - Mattermost Confluence Plugin Unauthenticated Channel Subscription Information Disclosure

CVE ID : CVE-2025-44001
Published : Aug. 11, 2025, 7:15 p.m. | 2 hours, 30 minutes ago
Description : Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the channel which allows attackers to get channel subscription details without proper access to the channel via API call to the Get Channel Subscriptions details endpoint.
Severity: 4.0 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 19:15:00 GMT

CVE-2025-44004 - Mattermost Confluence Plugin Auth Bypass

CVE ID : CVE-2025-44004
Published : Aug. 11, 2025, 7:15 p.m. | 2 hours, 30 minutes ago
Description : Mattermost Confluence Plugin version <1.5.0 fails to check the authorization of the user to the Mattermost instance which allows attackers to create a channel subscription without proper authorization via API call to the create channel subscription endpoint.
Severity: 7.2 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 19:15:00 GMT

CVE-2025-48731 - Mattermost Confluence Plugin Unauthorized Access and Subscription Manipulation Vulnerability

CVE ID : CVE-2025-48731
Published : Aug. 11, 2025, 7:15 p.m. | 2 hours, 30 minutes ago
Description : Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the Confluence space which allows attackers to edit a subscription for a Confluence space the user does not have access for via edit subscription endpoint.
Severity: 6.4 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 19:15:00 GMT

CVE-2025-49221 - Mattermost Confluence Plugin Authentication Bypass

CVE ID : CVE-2025-49221
Published : Aug. 11, 2025, 7:15 p.m. | 2 hours, 30 minutes ago
Description : Mattermost Confluence Plugin version <1.5.0 fails to enforce authentication of the user to the Mattermost instance which allows unauthenticated attackers to access subscription details without via API call to GET subscription endpoint.
Severity: 3.7 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 19:15:00 GMT

CVE-2025-25231 - VMware Workspace ONE UEM Path Traversal Information Disclosure

CVE ID : CVE-2025-25231
Published : Aug. 11, 2025, 6:15 p.m. | 2 hours, 20 minutes ago
Description : Omnissa Workspace ONE UEM contains a Secondary Context Path Traversal Vulnerability. A malicious actor may be able to gain access to sensitive information by sending crafted GET requests (read-only) to restricted API endpoints.
Severity: 7.5 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 18:15:00 GMT

CVE-2025-53187 - ABB ASPECT Code Injection Vulnerability

CVE ID : CVE-2025-53187
Published : Aug. 11, 2025, 6:15 p.m. | 2 hours, 20 minutes ago
Description : Improper Control of Generation of Code ('Code Injection') vulnerability in ABB ASPECT.This issue affects ASPECT: before <3.08.04-s01.
Severity: 7.0 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 18:15:00 GMT

CVE-2025-54063 - Cherry Studio Custom URL Handler Remote Code Execution Vulnerability

CVE ID : CVE-2025-54063
Published : Aug. 11, 2025, 6:15 p.m. | 2 hours, 20 minutes ago
Description : Cherry Studio is a desktop client that supports for multiple LLM providers. From versions 1.4.8 to 1.5.0, there is a one-click remote code execution vulnerability through the custom URL handling. An attacker can exploit this by hosting a malicious website or embedding a specially crafted URL on any website. If a victim clicks the exploit link in their browser, the app’s custom URL handler is triggered, leading to remote code execution on the victim’s machine. This issue has been patched in version 1.5.1.
Severity: 8.0 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 18:15:00 GMT

CVE-2025-8866 - YugabyteDB Anywhere Authentication Bypass

CVE ID : CVE-2025-8866
Published : Aug. 11, 2025, 5:15 p.m. | 1 hour, 20 minutes ago
Description : YugabyteDB Anywhere web server does not properly enforce authentication for the /metamaster/universe API endpoint. An unauthenticated attacker could exploit this flaw to obtain server networking configuration details, including private and public IP addresses and DNS records.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 17:15:00 GMT

CVE-2025-38499 - Linux Kernel Clone Private Mnt userns Privilege Escalation Vulnerability

CVE ID : CVE-2025-38499
Published : Aug. 11, 2025, 4:15 p.m. | 2 hours, 20 minutes ago
Description : In the Linux kernel, the following vulnerability has been resolved: clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns What we want is to verify there is that clone won't expose something hidden by a mount we wouldn't be able to undo. "Wouldn't be able to undo" may be a result of MNT_LOCKED on a child, but it may also come from lacking admin rights in the userns of the namespace mount belongs to. clone_private_mnt() checks the former, but not the latter. There's a number of rather confusing CAP_SYS_ADMIN checks in various userns during the mount, especially with the new mount API; they serve different purposes and in case of clone_private_mnt() they usually, but not always end up covering the missing check mentioned above.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 16:15:00 GMT

CVE-2025-45146 - ModelCache for LLM Deserialization Vulnerability

CVE ID : CVE-2025-45146
Published : Aug. 11, 2025, 4:15 p.m. | 2 hours, 20 minutes ago
Description : ModelCache for LLM through v0.2.0 was discovered to contain an deserialization vulnerability via the component /manager/data_manager.py. This vulnerability allows attackers to execute arbitrary code via supplying crafted data.
Severity: 9.8 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 16:15:00 GMT

CVE-2012-10037 - Apache PhpTax Remote Code Execution Vulnerability

CVE ID : CVE-2012-10037
Published : Aug. 11, 2025, 3:15 p.m. | 3 hours, 20 minutes ago
Description : PhpTax version 0.8 contains a remote code execution vulnerability in drawimage.php. The pfilez GET parameter is unsafely passed to the exec() function without sanitization. A remote attacker can inject arbitrary shell commands, leading to code execution under the web server's context. No authentication is required.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 15:15:00 GMT

CVE-2012-10038 - Auxilium RateMyPet Unauthenticated Remote Code Execution (RCE) via File Upload

CVE ID : CVE-2012-10038
Published : Aug. 11, 2025, 3:15 p.m. | 3 hours, 20 minutes ago
Description : Auxilium RateMyPet contains an unauthenticated arbitrary file upload vulnerability in upload_banners.php. The banner upload feature fails to validate file types or enforce authentication, allowing remote attackers to upload malicious PHP files. These files are stored in a web-accessible /banners/ directory and can be executed directly, resulting in remote code execution.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 15:15:00 GMT

CVE-2012-10039 - ZEN Load Balancer Root Code Execution Vulnerability

CVE ID : CVE-2012-10039
Published : Aug. 11, 2025, 3:15 p.m. | 3 hours, 20 minutes ago
Description : ZEN Load Balancer versions 2.0 and 3.0-rc1 contain a command injection vulnerability in content2-2.cgi. The filelog parameter is passed directly into a backtick-delimited exec() call without sanitation. An authenticated attacker can inject arbitrary shell commands, resulting in remote code execution as the root user. ZEN Load Balancer is the predecessor of ZEVENET and SKUDONET. The affected versions (2.0 and 3.0-rc1) are no longer supported. SKUDONET CE is the current community-maintained successor.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 15:15:00 GMT

CVE-2012-10040 - Openfiler Command Injection Vulnerability

CVE ID : CVE-2012-10040
Published : Aug. 11, 2025, 3:15 p.m. | 3 hours, 20 minutes ago
Description : Openfiler v2.x contains a command injection vulnerability in the system.html page. The device parameter is used to instantiate a NetworkCard object, whose constructor in network.inc calls exec() with unsanitized input. An authenticated attacker can exploit this to execute arbitrary commands as the openfiler user. Due to misconfigured sudoers, the openfiler user can escalate privileges to root via sudo /bin/bash without a password.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 15:15:00 GMT

CVE-2025-8859 - Code-projects eBlog Site File Upload Module Unrestricted Upload Vulnerability

CVE ID : CVE-2025-8859
Published : Aug. 11, 2025, 3:15 p.m. | 3 hours, 20 minutes ago
Description : A vulnerability was identified in code-projects eBlog Site 1.0. Affected by this vulnerability is an unknown functionality of the file /native/admin/save-slider.php of the component File Upload Module. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Severity: 6.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 15:15:00 GMT

CVE-2025-8865 - YugabyteDB YCQL DoS Denial of Service

CVE ID : CVE-2025-8865
Published : Aug. 11, 2025, 3:15 p.m. | 3 hours, 20 minutes ago
Description : The YugabyteDB tablet server contains a flaw in its YCQL query handling that can trigger a null pointer dereference when processing certain malformed inputs. An authenticated attacker could exploit this issue to crash the YCQL tablet server, resulting in a denial of service.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 15:15:00 GMT

CVE-2025-8851 - LibTIFF Stack-Based Buffer Overflow

CVE ID : CVE-2025-8851
Published : Aug. 11, 2025, 2:15 p.m. | 4 hours, 20 minutes ago
Description : A vulnerability was determined in LibTIFF up to 4.5.1. Affected by this issue is the function readSeparateStripsetoBuffer of the file tools/tiffcrop.c of the component tiffcrop. The manipulation leads to stack-based buffer overflow. Local access is required to approach this attack. The patch is identified as 8a7a48d7a645992ca83062b3a1873c951661e2b3. It is recommended to apply a patch to fix this issue.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 14:15:00 GMT

CVE-2025-8852 - WuKongOpenSource WukongCRM File Upload API Response Handler Information Exposure Vulnerability

CVE ID : CVE-2025-8852
Published : Aug. 11, 2025, 2:15 p.m. | 4 hours, 20 minutes ago
Description : A vulnerability was identified in WuKongOpenSource WukongCRM 11.0. This affects an unknown part of the file /adminFile/upload of the component API Response Handler. The manipulation leads to information exposure through error message. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Severity: 4.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 14:15:00 GMT

CVE-2025-8864 - Yugabyte Shared Access Signature Token Exposed

CVE ID : CVE-2025-8864
Published : Aug. 11, 2025, 2:15 p.m. | 4 hours, 20 minutes ago
Description : Shared Access Signature token is not masked in the backup configuration response and is also exposed in the yb_backup logs
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 14:15:00 GMT

CVE-2025-8672 - GIMP for MacOS Local Privilege Escalation

CVE ID : CVE-2025-8672
Published : Aug. 11, 2025, 1:15 p.m. | 5 hours, 20 minutes ago
Description : MacOS version of GIMP bundles a Python interpreter that inherits the Transparency, Consent, and Control (TCC) permissions granted by the user to the main application bundle. An attacker with local user access can invoke this interpreter with arbitrary commands or scripts, leveraging the application's previously granted TCC permissions to access user's files in privacy-protected folders without triggering user prompts. Accessing other resources beyond previously granted TCC permissions will prompt the user for approval in the name of GIMP, potentially disguising attacker's malicious intent. This issue has been fixed in 3.1.4.2 version of GIMP.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 13:15:00 GMT

CVE-2025-8845 - "NASM Netwide Assembler Stack-Based Buffer Overflow Vulnerability"

CVE ID : CVE-2025-8845
Published : Aug. 11, 2025, 1:15 p.m. | 5 hours, 20 minutes ago
Description : A vulnerability was identified in NASM Netwide Assember 2.17rc0. This issue affects the function assemble_file of the file nasm.c. The manipulation leads to stack-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 13:15:00 GMT

CVE-2025-8846 - "NASM Netwide Assembler Stack-Based Buffer Overflow"

CVE ID : CVE-2025-8846
Published : Aug. 11, 2025, 1:15 p.m. | 5 hours, 20 minutes ago
Description : A vulnerability has been found in NASM Netwide Assember 2.17rc0. Affected is the function parse_line of the file parser.c. The manipulation leads to stack-based buffer overflow. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 13:15:00 GMT

CVE-2025-8847 - RuoYi Yangzongzhuan Cross-Site Scripting Vulnerability

CVE ID : CVE-2025-8847
Published : Aug. 11, 2025, 1:15 p.m. | 5 hours, 20 minutes ago
Description : A vulnerability was found in yangzongzhuan RuoYi up to 4.8.1. Affected by this vulnerability is the function Edit of the file /system/notice/edit. The manipulation of the argument noticeTitle/noticeContent leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Severity: 3.5 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 13:15:00 GMT

CVE-2025-8862 - YugabyteDB Information Disclosure Vulnerability

CVE ID : CVE-2025-8862
Published : Aug. 11, 2025, 1:15 p.m. | 5 hours, 20 minutes ago
Description : YugabyteDB has been collecting diagnostics information from YugabyteDB servers, which may include sensitive gflag configurations. To mitigate this, we recommend upgrading the database to a version where this information is properly redacted.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 13:15:00 GMT

CVE-2025-8863 - YugabyteDB Information Disclosure

CVE ID : CVE-2025-8863
Published : Aug. 11, 2025, 1:15 p.m. | 5 hours, 20 minutes ago
Description : YugabyteDB diagnostic information was transmitted over HTTP, which could expose sensitive data during transmission
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 13:15:00 GMT

CVE-2025-8844 - "NASM Netwide Assembler Null Pointer Dereference Vulnerability"

CVE ID : CVE-2025-8844
Published : Aug. 11, 2025, 12:15 p.m. | 6 hours, 20 minutes ago
Description : A vulnerability was determined in NASM Netwide Assember 2.17rc0. This vulnerability affects the function parse_smacro_template of the file preproc.c. The manipulation leads to null pointer dereference. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.
Severity: 3.3 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 12:15:00 GMT

CVE-2025-8842 - NASM Netwide Assembler Use After Free Vulnerability

CVE ID : CVE-2025-8842
Published : Aug. 11, 2025, 11:15 a.m. | 7 hours, 20 minutes ago
Description : A vulnerability has been found in NASM Netwide Assember 2.17rc0. Affected by this issue is the function do_directive of the file preproc.c. The manipulation leads to use after free. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 11:15:00 GMT

CVE-2025-8843 - NASM Netwide Assembler Heap-Based Buffer Overflow

CVE ID : CVE-2025-8843
Published : Aug. 11, 2025, 11:15 a.m. | 7 hours, 20 minutes ago
Description : A vulnerability was found in NASM Netwide Assember 2.17rc0. This affects the function macho_no_dead_strip of the file outmacho.c. The manipulation leads to heap-based buffer overflow. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 11:15:00 GMT

CVE-2025-8841 - Zlt2000 Microservices-Platform Unrestricted File Upload Vulnerability

CVE ID : CVE-2025-8841
Published : Aug. 11, 2025, 10:15 a.m. | 8 hours, 20 minutes ago
Description : A vulnerability was identified in zlt2000 microservices-platform up to 6.0.0. Affected by this vulnerability is the function Upload of the file zlt-business/file-center/src/main/java/com/central/file/controller/FileController.java. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Severity: 6.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 10:15:00 GMT

CVE-2025-8840 - jshERP Unauthenticated Remote Code Execution

CVE ID : CVE-2025-8840
Published : Aug. 11, 2025, 10:15 a.m. | 7 hours, 54 minutes ago
Description : A vulnerability was determined in jshERP up to 3.5. Affected is an unknown function of the file /jshERP-boot/user/deleteBatch of the component Endpoint. The manipulation of the argument ids leads to improper authorization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Different than CVE-2025-7947.
Severity: 5.4 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 10:15:00 GMT

CVE-2025-8839 - jshERP Remote Authorization Bypass Vulnerability

CVE ID : CVE-2025-8839
Published : Aug. 11, 2025, 9:15 a.m. | 8 hours, 55 minutes ago
Description : A vulnerability was found in jshERP up to 3.5. This issue affects some unknown processing of the file /jshERP-boot/user/addUser of the component Endpoint. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Severity: 6.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 09:15:00 GMT

CVE-2025-8853 - 2100 Technology Official Document Management System Authentication Bypass

CVE ID : CVE-2025-8853
Published : Aug. 11, 2025, 9:15 a.m. | 8 hours, 55 minutes ago
Description : Official Document Management System developed by 2100 Technology has an Authentication Bypass vulnerability, allowing unauthenticated remote attackers to obtain any user's connection token and use it to log into the system as that user.
Severity: 9.8 | CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 09:15:00 GMT

CVE-2025-8838 - WinterChenS my-site PreHandle Uri Improper Authentication Remote Vulnerability

CVE ID : CVE-2025-8838
Published : Aug. 11, 2025, 9:15 a.m. | 7 hours, 57 minutes ago
Description : A vulnerability has been found in WinterChenS my-site up to 1f7525f15934d9d6a278de967f6ec9f1757738d8. This vulnerability affects the function preHandle of the file /admin/ of the component Backend Interface. The manipulation of the argument uri leads to improper authentication. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The code maintainer responded to the issue that "[he] tried it, and using this link automatically redirects to the login page."
Severity: 7.3 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 09:15:00 GMT

CVE-2025-8836 - JasPer JPEG2000 Encoder Reachable Assertion Vulnerability

CVE ID : CVE-2025-8836
Published : Aug. 11, 2025, 8:15 a.m. | 7 hours, 37 minutes ago
Description : A vulnerability was determined in JasPer up to 4.2.5. Affected by this issue is the function jpc_floorlog2 of the file src/libjasper/jpc/jpc_enc.c of the component JPEG2000 Encoder. The manipulation leads to reachable assertion. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The patch is identified as 79185d32d7a444abae441935b20ae4676b3513d4. It is recommended to apply a patch to fix this issue.
Severity: 3.3 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 08:15:00 GMT

CVE-2025-8837 - JasPer JPEG2000 File Handler Use After Free Vulnerability

CVE ID : CVE-2025-8837
Published : Aug. 11, 2025, 8:15 a.m. | 7 hours, 37 minutes ago
Description : A vulnerability was identified in JasPer up to 4.2.5. This affects the function jpc_dec_dump of the file src/libjasper/jpc/jpc_dec.c of the component JPEG2000 File Handler. The manipulation leads to use after free. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The patch is named 8308060d3fbc1da10353ac8a95c8ea60eba9c25a. It is recommended to apply a patch to fix this issue.
Severity: 5.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 08:15:00 GMT

CVE-2025-8660 - Apache Privilege Escalation Vulnerability

CVE ID : CVE-2025-8660
Published : Aug. 11, 2025, 8:15 a.m. | 6 hours, 25 minutes ago
Description : Privilege escalation occurs when a user gets access to more resources or functionality than they are normally allowed.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 08:15:00 GMT

CVE-2025-8661 - Apache Server Stored XSS

CVE ID : CVE-2025-8661
Published : Aug. 11, 2025, 8:15 a.m. | 6 hours, 25 minutes ago
Description : A stored Cross-Site Scripting vulnerability (XSS) occurs when the server does not properly validate or encode the data entered by the user.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 08:15:00 GMT

CVE-2025-8747 - Keras Safe Mode Bypass Arbitrary Code Execution

CVE ID : CVE-2025-8747
Published : Aug. 11, 2025, 8:15 a.m. | 6 hours, 25 minutes ago
Description : A safe mode bypass vulnerability in the `Model.load_model` method in Keras versions 3.0.0 through 3.10.0 allows an attacker to achieve arbitrary code execution by convincing a user to load a specially crafted `.keras` model archive.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 08:15:00 GMT

CVE-2025-8833 - Linksys RE Series Stack-Based Buffer Overflow Vulnerability

CVE ID : CVE-2025-8833
Published : Aug. 11, 2025, 7:15 a.m. | 7 hours, 25 minutes ago
Description : A vulnerability was identified in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. This issue affects the function langSwitchBack of the file /goform/langSwitchBack. The manipulation of the argument langSelectionOnly leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 07:15:00 GMT

CVE-2025-8834 - JCG Link-net LW-N915R Cross-Site Scripting Vulnerability

CVE ID : CVE-2025-8834
Published : Aug. 11, 2025, 7:15 a.m. | 7 hours, 25 minutes ago
Description : A vulnerability has been found in JCG Link-net LW-N915R 17s.20.001.908. Affected is an unknown function of the file /wireless/basic.asp of the component Wireless Basic Settings Page. The manipulation of the argument Network Name leads to cross site scripting. It is possible to launch the attack remotely.
Severity: 2.4 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 07:15:00 GMT

CVE-2025-8835 - JasPer Jas Image Color Space Conversion Handler Null Pointer Dereference

CVE ID : CVE-2025-8835
Published : Aug. 11, 2025, 7:15 a.m. | 7 hours, 25 minutes ago
Description : A vulnerability was found in JasPer up to 4.2.5. Affected by this vulnerability is the function jas_image_chclrspc of the file src/libjasper/base/jas_image.c of the component Image Color Space Conversion Handler. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The identifier of the patch is bb7d62bd0a2a8e0e1fdb4d603f3305f955158c52. It is recommended to apply a patch to fix this issue.
Severity: 3.3 | LOW
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 07:15:00 GMT

CVE-2025-7965 - "CBX Restaurant Booking WordPress CSRF Settings Update Vulnerability"

CVE ID : CVE-2025-7965
Published : Aug. 11, 2025, 6:15 a.m. | 7 hours, 32 minutes ago
Description : The CBX Restaurant Booking WordPress plugin through 1.2.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 06:15:00 GMT

CVE-2025-8832 - Linksys WAP Stack-Based Buffer Overflow Vulnerability

CVE ID : CVE-2025-8832
Published : Aug. 11, 2025, 6:15 a.m. | 7 hours, 32 minutes ago
Description : A vulnerability was determined in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. This vulnerability affects the function setDMZ of the file /goform/setDMZ. The manipulation of the argument DMZIPAddress leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 06:15:00 GMT

CVE-2025-8854 - Bullet Physics LoadOFF Stack-based Buffer Overflow Vulnerability

CVE ID : CVE-2025-8854
Published : Aug. 11, 2025, 5:15 a.m. | 8 hours, 32 minutes ago
Description : Stack-based buffer overflow in LoadOFF in bulletphysics bullet3 before 3.26 on all platforms allows remote attackers to execute arbitrary code via a crafted OFF file with an overlong initial token processed by the VHACD test utility or invoked indirectly through PyBullet's vhacd function.
Severity: 0.0 | NA
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 05:15:00 GMT

CVE-2025-8830 - Linksys Router Os Command Injection Vulnerability

CVE ID : CVE-2025-8830
Published : Aug. 11, 2025, 5:15 a.m. | 8 hours, 13 minutes ago
Description : A vulnerability has been found in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. Affected by this issue is the function sub_3517C of the file /goform/setWan. The manipulation of the argument Hostname leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity: 6.3 | MEDIUM
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 05:15:00 GMT

CVE-2025-8831 - Linksys Wireless Router Remote Management Stack Buffer Overflow Vulnerability

CVE ID : CVE-2025-8831
Published : Aug. 11, 2025, 5:15 a.m. | 8 hours, 13 minutes ago
Description : A vulnerability was found in Linksys RE6250, RE6300, RE6350, RE6500, RE7000 and RE9000 up to 20250801. This affects the function remoteManagement of the file /goform/remoteManagement. The manipulation of the argument portNumber leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity: 8.8 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Mon, 11 Aug 2025 05:15:00 GMT

CVE-2025-27577 - Apache OpenHarmony TCB Arbitrary Code Execution Vulnerability